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IN  THE  UNITED  STATES  DISTRICT  COURT 
FOR  THE  DISTRICT  OF  DELAWARE 


) 

BEN  REDMOND;  LINDSAY  RATHERT;  ) 
SALVADOR  RAMIREZ;  GERRY  ) 

GALIPAULT;  KYLE  WESTENDORF,  ) 
ROBERT  WOODS,  and  JORDAN  ) 

HUNSTONE,  individually  and  on  behalf  ) 
of  all  others  similarly  situated,  ) 

) 

Plaintiffs,  ) 

) 

v.  ) 

) 

FACEBOOK,  INC.;  GLOBAL  SCIENCE  ) 
RESEARCH  LTD;  ALEKSANDR  ) 

KOGAN;  SCL  GROUP  LIMITED;  SCL  ) 
ELECTIONS  LTD;  SCL  USA  INC.;  ) 
CAMBRIDGE  ANALYTICA  LLC;  ) 

CAMBRIDGE  ANALYTICA  HOLDINGS  ) 
LLC;  CAMBRIDGE  ANALYTICA  ) 

COMMERCIAL  LLC;  and  CAMBRIDGE  ) 
ANALYTICA  POLITICAL  LLC,  ) 

) 

Defendants.  ) 

_ ) 


Case  No. 

CLASS  ACTION  COMPLAINT  FOR: 

1 .  Violation  of  Stored  Communication 
Act,  18  U.S.C.  §  2071,  et  seq. 

2.  Fraud 

3.  Negligence 

4.  Willful  Negligence 


CLASS  ACTION  COMPLAINT 


Plaintiffs,  Ben  Redmond,  Lindsay  Rathert,  Salvador  Ramirez,  Gerry  Galipault,  Kyle 
Westendorf,  Robert  Woods,  and  Jordan  Hunstone  on  behalf  of  themselves  and  all  others  similarly 
situated,  by  and  through  their  undersigned  counsel,  upon  knowledge  as  to  themselves  and 
otherwise  upon  information  and  belief,  allege  against  Defendants  Facebook,  Inc.  (“Facebook”); 
Global  Science  Research  Ltd.  (“GSR”);  Aleksandr  Kogan  (“Kogan”);  SCL  Group  Limited;  (“SCL 
Group”);  SCL  Elections  Ltd.  (“SCL  Elections”);  SCL  USA  Inc.  (“SCL  USA”)  (collectively  “SCL 
Entities”);  Cambridge  Analytica  LLC;  Cambridge  Analytica  Holdings  LLC;  Cambridge  Analytica 
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Commercial  LLC;  and  Cambridge  Analytica  Political  LLC  (collectively  “Cambridge,”  and 
together  with  Facebook  and  SCL  Entities,  “Defendants”)  as  follows: 

SUMMARY  OF  CLAIMS 

1.  This  is  a  class  action  lawsuit  brought  by  Plaintiffs  on  behalf  of  similarly  situated 
individuals  who  are  registered  users  of  Facebook  and  whose  personal  information  was  improperly 
and  without  authorization  accessed  and/or  obtained  by  GSR,  Kogan,  SCL  Entities  and  Cambridge. 

2.  In  2011,  Facebook  entered  into  a  consent  decree  with  the  Federal  Trade 
Commission  that  required  Facebook  to,  inter  alia ,  “not  misrepresent  in  any  manner,  expressly  or 
by  implication,  the  extent  to  which  it  maintains  the  privacy  or  security  of  covered  information, 
including,  but  not  limited  to:  ...  (C)  the  extent  to  which  [Facebook]  makes  or  has  made  covered 
information  accessible  to  third  parties;”1 

3.  Covered  information  is  defined  in  the  FTC  Consent  Order  as: 

[Information  from  or  about  an  individual  consumer  including,  but  not 
limited  to:  (a)  a  first  or  last  name;  (b)  a  home  or  other  physical  address, 
including  street  name  and  name  of  city  or  town;  (c)  an  email  address  or 
other  online  contact  information,  such  as  an  instant  messaging  user 
identifier  or  a  screen  name;  (d)  a  mobile  or  other  telephone  number;  (e) 
photos  and  videos;  (f)  Internet  Protocol  (“IP”)  address,  User  ID  or  other 
persistent  identified;  (g)  physical  location;  or  (h)  any  information  combined 
with  any  of  (a)  through  (g)  above.2 

4.  Further,  Facebook  was  ordered  to: 

[I]n  connection  with  any  product  or  service,  in  or  affecting  commerce,  prior 
to  any  sharing  of  a  user’s  nonpublic  information  by  [Facebook]  with  any 
third  party,  which  materially  exceeds  the  restrictions  imposed  by  a  user’s 
privacy  setting(s),  shall:  A.  clearly  and  prominently  disclose  to  the  user, 
separate  and  apart  from  any  “privacy  policy,”  “data  use  policy,”  “statement 
of  rights  and  responsibilities”  page,  or  other  similar  document:  (1)  the 
categories  of  nonpublic  user  information  that  will  be  disclosed  to  such  third 
parties,  (2)  the  identity  or  specific  categories  of  such  third  parties,  and  (3) 


1  In  the  Matter  of  Facebook,  Inc.,  a  corporation.  Agreement  Containing  Consent  Order,  at  Section  I.C.  (“FTC 
Consent  Order”). 

2  FTC  Consent  Order,  at  Section  Definitions,  4. 
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that  such  sharing  exceeds  the  restrictions  imposed  by  the  privacy  setting(s) 
in  effect  for  the  user;  and  B.  obtain  the  user’s  affirmative  express  consent.3 

5.  In  2014,  Defendants  GSR,  Kogan,  SCL  Entities,  and  Cambridge  improperly,  and 
without  authorization,  in  violation  of  the  Stored  Communications  Act,  18  U.S.C.  §§  2701,  et  seq., 
obtained  the  personal  information  of  approximately  87  million  registered  Facebook  users, 
approximately  70.6  million  of  whom  were  in  the  U.S.  and  approximately  1  million  of  which  were 
in  the  U.K.,4  without  their  knowledge,  consent,  or  authorization.5  This  information  included  the 
users’  full  names,  telephone  numbers,  mailing  addresses,  email  addresses,  ages,  interests,  physical 
locations,  political  and  religious  affiliations,  relationships,  pages  they  have  liked,  and  groups  to 
which  they  belong. 

6.  Defendant  Facebook,  contrary  to  the  representations,  obligations,  and  promises 
made  to  the  federal  government  in  2011,  knowingly  set  up  its  platform  such  that  a  third-party 
application  developer  who  gained  access  to  a  user  through  an  application  could  also  access  the 
personal  information  and  data  of  that  user’s  friends  in  violation  of  the  Stored  Communications 
Act,  18  U.S.C.  §§  2701,  et  seq.  In  addition,  Facebook  negligently  failed  to  protect  its  users’  data 
from  such  unauthorized  access  by  a  third  party;  upon  learning  about  this  unauthorized  access  and 
use  of  the  personal  data,  failed  to  take  reasonable  steps  required  to  claw  back  or,  in  the  alternative, 
ensure  the  destruction  of  this  data;  and  failed  to  notify  its  users’  that  such  a  breach  had  occurred, 
only  admitting  to  the  breach  after  their  negligence  was  disclosed  by  a  whistleblower. 


3  FTC  Consent  Order,  at  Section  II. A.  and  II.B. 

4  https://www.wsi.com/articles/mark-zuckerberg-to-testify-before-house-committee-on-april-ll- 
1522844990?emailToken=b6039753815a6ft)549210722e887fl4av3KEs4TOaOIbKRj'bYLLs22td%2FrKr)5vfbe9pO 
OP3CdaSDUFWHvMliLvOCKo0tPnnazCRiOHRE%2BOT4%2FvgEOiHfZM38dqDgrgkiLa4nc328MPuGOUO2x 
G%2FtuMgpF  dsknn  vTH 

5  Because  the  proposed  Class  includes  only  those  users  from  the  United  States  and  the  U.K.,  we  will  use  the  71.6 
million  number  throughout  the  Complaint. 
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JURISDICTION  AND  VENUE 

7.  This  Court  has  personal  jurisdiction  over  Defendants  Facebook,  SCL  USA  Inc., 
Cambridge  Analytica  LLC,  Cambridge  Analytica  Holdings,  LLC,  Cambridge  Analytica 
Commercial  LLP,  and  Cambridge  Analytica  Political  LLC  because  they  are  each  incorporated 
under  the  laws  of  Delaware. 

8.  This  Court  has  personal  jurisdiction  over  Defendants  GSR,  Kogan,  SCL  Group 
Limited,  and  SCL  Elections  Ltd  because;  (i)  Defendant  SCL  USA  Inc.  is  the  alter  ego  of  SCL 
Group  Limited  and  SCL  Elections  Ltd;  (ii)  GSR  is  the  alter  ego  of  Kogan;  (iii)  they  each  entered 
into  a  contract  which  required,  by  its  very  terms,  an  impact  on  U.S.  citizens,  including  those  located 
in  Delaware;6  (iv)  they  have  each  done  business  in  Delaware  and  have  caused  tortious  injury  in 
Delaware;  and  (v)  because,  on  information  and  belief.  Defendants  GSR,  Kogan,  SCL  Group 
Limited  and  SCL  Elections  Ltd  took  steps  to  improperly  evade  jurisdiction  in  this  district  by 
utilizing  non-U.S.  employees  for  work  undertaken  in  the  U.S.7 

9.  This  Court  has  subject  matter  jurisdiction  over  this  action  and  each  Defendant 
pursuant  to  28  U.S. C.  §  1331  because  this  action  arises  under  federal  statute,  namely  the  Stored 
Communication  Act,  1 8  U.S.C.  §  2701,  et  seq.  (“SCA”)  and  pursuant  to  the  Class  Action  Fairness 
Act,  28  U.S.C.  §  1332(d)  (“CAFA”)  because  the  aggregate  amount  in  controversy  exceeds 
$5,000,000,  exclusive  of  interests  and  costs,  there  are  more  than  100  class  members,  and  at  least 
one  class  member  is  a  citizen  of  a  state  different  from  Defendants  and  is  a  citizen  of  a  foreign  state. 


6  See,  Contract  between  Global  Services  Research  Ltd  and  SCL  Elections  Ltd,  attached  hereto  as  Exhibit  1  (“GSR 
Contract”),  at  Schedule  1. 

7  https://www.thestar.com/news/world/2018/03/25/former-cambridge-analvtica-workers-sav-firin-sent-foreianers-to- 
advise-us-campaigns  html;  https://www.theguardian.com/uk-news/20 1 8/mar/l  7/cambridge-analytica-non-american- 
employees-political 
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10.  Venue  is  proper  in  this  District  because  each  of  the  Defendants  either  conducts 
business  in  this  District  and/or  is  incorporated  under  the  laws  of  Delaware. 

THE  PARTIES 

1 1 .  Plaintiff  Ben  Redmond  is  an  adult  domiciled  in  California.  Mr.  Redmond  has  been 
registered  with  Facebook  since  at  least  2007  and  did  not  utilize  or  otherwise  access  the  application 
thisisyourdigitallife.  com. 

12.  Plaintiff  Lindsay  Rathert  is  an  adult  domiciled  in  Illinois.  Ms.  Rathert  has  been 
registered  with  Facebook  at  least  since  2004  and  did  not  utilize  or  otherwise  access  the  application 
thisisyourdigitallife.  com. 

13.  Plaintiff  Kyle  Westendorf  is  an  adult  domiciled  in  Ohio.  Mr.  Westendorf  has  been 
registered  with  Facebook  at  least  since  2006  and  did  not  utilize  or  otherwise  access  the  application 
thisisyourdigitallife.  com. 

14.  Plaintiff  Salvador  Ramirez  is  an  adult  domiciled  in  Texas.  Mr.  Ramirez  has  been 
registered  with  Facebook  at  least  since  2005  and  did  not  utilize  or  otherwise  access  the  application 
thisisyourdigitallife.com. 

15.  Plaintiff  Gerry  Galipault  is  an  adult  domiciled  in  Florida.  Mr.  Galipault  has  been 
registered  with  Facebook  at  least  since  2008  and  did  not  utilize  or  otherwise  access  the  application 
thisisyourdigitallife.  com. 

16.  Plaintiff  Robert  Woods  is  an  adult  domiciled  in  Greater  London,  England.  Mr. 
Woods  has  been  registered  with  Facebook  at  least  since  2007  and  did  not  utilize  or  otherwise 
access  the  application  thisisyourdigitallife.com. 
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1 7.  Plaintiff  Jordan  Hunstone  is  an  adult  domiciled  in  Great  Manchester,  England.  Mr. 
Hunstone  has  been  registered  with  Facebook  at  least  since  2012  and  did  not  utilize  or  otherwise 
access  the  application  thisisyourdigitallife.com. 

18.  Defendant  Facebook,  Inc.  (“Facebook”)  is  incorporated  in  Delaware  and  has  its 
principal  executive  offices  at  1  Hacker  Way,  Menlo  Park,  California  94025  and  its  registered  agent 
for  service  of  summons  is  Corporation  Service  Company,  251  Little  Falls  Drive,  Wilmington,  DE 
19808. 

19.  Defendant  Global  Science  Research  Ltd  (“GSR”)  was  incorporated  as  a  private 
limited  company  in  England  on  May  29,  2014  and  its  registered  address  is  49  Peter  Street,  6th 
Floor,  Manchester,  England,  M2  3NG.  It  also  had  offices  at  Magdalene  College,  Cambridge,  CB3 
0AG,  United  Kingdom. 

20.  Defendant  Aleksandr  Kogan  is  a  founding  director  of  Global  Science  Research  Ltd, 
and  now  lives  in  the  Bay  Area,  in  Northern  California,  United  States.8 

21.  Defendant  SCL  Group  Limited  (“SCL  Group”),  formerly  known  as  Strategic 
Communications  Laboratories  Ltd,  is  a  British  company  registered  with  the  UK  Companies  House 
in  2005. 9  Its  headquarters  are  located  at  55  New  Oxford  Street,  London,  WC1A  IBS.  SCL  Group 
also  has  multiple  U.S.  affiliates  including  SCL  Group  Inc.  with  offices  in  New  York  located  at  597 
5th  Avenue,  7th  Floor,  New  York,  New  York,  10036,  and  SCL  USA  Inc.  with  offices  in 
Washington,  D.C.  located  at  1901  Pennsylvania  Ave,  N.W.,  Washington,  D.C.  20006. 

22.  SCL  Elections  Ltd  (“SCL  Elections”)  is  a  British  company  incorporated  on  October 
17,  2012.  Its  address  is  listed  as  c/o  PFK  Littlejohn,  chartered  accountants  located  at  1  Westferry 


8  https://www.theguardian.com/news/2018/mar/18/facebook-cambridge-analvtica-ioseph-chancellor-gsr 

9  https://medium.eom/@wsiegelman/scl-companies-shareholders-e65a4G94158 
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Circus,  Canary  Wharf,  London,  E14  4HD,  UK.  Alexander  Nix  is  listed  as  a  director  of  SCL 
Elections  and  the  ultimate  controlling  party  as  of  the  end  of  20 15. 10 

23.  SCL  USA  Inc.  (“SCL  USA”),  is  a  privately  held  company  incorporated  under  the 
laws  of  the  State  of  Delaware,  incorporated  on  April  22,  2104,  and  is  a  wholly  owned  subsidiary 
of  SCL  Elections.  Its  address  is  597  5th  Avenue,  7th  floor,  New  York,  NY  10017  and  its  registered 
agent  for  service  of  summons  is  Erisedentagent,  Inc.,  1013  Centre  Road,  Suite  403  S,  Wilmington, 
DE  19805.  Alexander  Nix  is  listed  as  the  CEO.1 1  SCL  USA  is  the  alter  ego  of  SCL  Group. 

24.  Defendant  Cambridge  Analytica  LLC  (“Cambridge  Analytica”)  is  a  privately  held 
limited  liability  company  organized  under  the  laws  of  the  State  of  Delaware,  incorporated  on 
December  31,  2013,  with  its  principal  offices  located  at  597  5th  Avenue,  7th  Floor,  New  York,  NY 
10017.  Cambridge  Analytica  also  has  offices  in  Washington,  D.C.  and  its  registered  agent  for 
service  of  summons  is  The  Corporation  Trust  Company,  1209  Orange  Street,  Corporation  Trust 
Center,  Wilmington,  DE  19801.  According  to  The  Guardian  and  Business  Insider,  Steve  Bannon 
was  Vice  President  of  Cambridge  Analytica  from  June  2014  until  August  2016. 12>13 

25.  Defendant  Cambridge  Analytica  Holdings,  LLC  (“CA  Holdings”)  is  a  privately 
held  limited  liability  company  organized  under  the  laws  of  the  State  of  Delaware,  incorporated  on 
May  9,  2014.  Cambridge  Analytica  Holdings,  LLC’s  registered  agent  for  service  of  summons  is 
The  Corporation  Trust  Company,  1209  Orange  Street,  Corporation  Trust  Center,  Wilmington,  DE 
19801.  According  to  The  Guardian,  hedge  fund  billionaire  Robert  Mercer  funded  CA  Holdings, 
which  created  and  initially  ran  Cambridge  Analytica.14 


10  https://s3-eu-west-l.amazonaws.com/document-api-images- 
prod/docs/LJ4d6DCFawQ3eIThD55rCIL5Tj_KjkS9pvCsgNx5HcU/application-pdf 

1 1  https://www.manta.eom/c/mh  1  vpkg/scl-usa-inc 

12  https://www.theguardian.com/news/20 1 8/mar/17/cambridge-analytica-facebook-influence-us-election 

13  http://www.businessinsider.com/steve-bannon-ties-to-cambridge-analytica-facebook-data-run-deep-2018-3 

14  https://www.theguardian.com/news/2018/mar/17/cambridge-analytica-facebook-influence-us-election 
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26.  Defendant  Cambridge  Analytica  Commercial  LLC  (“CA  Commercial”)  is  a 
privately  held  limited  liability  company  organized  under  the  laws  of  the  State  of  Delaware, 
incorporated  on  January  21,  2015,  and  is  a  division  of  Cambridge  Analytica.  CA  Commercial’s 
registered  agent  for  service  of  summons  is  The  Corporation  Trust  Company,  1209  Orange  Street, 
Corporation  Trust  Center,  Wilmington,  DE  19801.  Cambridge  Analytica  is  owned  in  part  (19%) 
by  SCL  Elections  Ltd,  a  British  company  owned  by  SCL  Analytics  Limited,  which  is  owned  in 
part  by  Defendant  SCL  Group.15  During  the  relevant  time,  Alexander  Nix  was  CEO  of  both  SCL 
Elections  Ltd  and  Cambridge  Analytica  UK. 

27.  Defendant  Cambridge  Analytica  Political  LLC  (“CA  Political”)  is  a  privately  held 
limited  liability  company  organized  under  the  laws  of  the  State  of  Delaware,  incorporated  on 
January  21,  2015,  and  is  a  division  of  Cambridge  Analytica.  CA  Political’s  registered  agent  for 
service  of  summons  is  The  Corporation  Trust  Company,  1209  Orange  Street,  Corporation  Trust 
Center,  Wilmington,  DE  19801. 

28.  Cambridge  Analytica,  CA  Political  and  CA  Commercial  all  share  the  same  website; 
https://cambridgeanalvtica.org.  According  to  Cambridge  Analytica  website,  CA  Political  and  CA 
Commercial  are  Divisions  of  Cambridge  Analytica  LLC.  Upon  information  and  belief,  CA 
Holdings  is  a  shell  holding  company  for  shares  of  Cambridge  Analytica,  CA  Political  and  CA 
Commercial. 

29.  There  is  no  ownership  relationship  between  Facebook  and  any  Cambridge  entity. 
Further,  no  Cambridge  entity  is  a  party  to  the  contract  between  Facebook  and  its  users. 


15  https://medium.eom/@wsiegelman/scl-companies-shareholders-e65a4f394158 
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FACTUAL  ALLEGATIONS 
Facebook’s  Deceptive  Data  Collection  Platform 

30.  Millions  of  Americans  who  use  Facebook  have  entrusted  Facebook  to  protect  their 
personal  data.  Facebook  expressly  assures  users  that,  “You  own  all  of  the  content  and  information 
you  post  on  Facebook,  and  you  can  control  how  it  is  shared  through  your  privacy  and  application 
settings.”16  This  representation  is  false  and  misleading. 

3 1 .  Facebook  has  known  for  years  that  its  platform  could  easily  and  readily  be  used  by 
third  parties  to  steal  users’  personal  information,  that  Facebook  was  not  adequately  monitoring 
activities  of  third-party  application  developers  to  whom  it  had  given  access  to  its  platform  and 
users’  personal  information,  that  users  were  unaware  of  the  extent  of  their  information  Facebook 
was  collecting,  and  that  Facebook  was  misleading  users  about  the  security  of  their  personal 
information.  Sandy  Parakilas,  the  platform  operations  manager  at  Facebook  responsible  for 
policing  data  breaches  by  third-party  software  developers  between  2011  and  2012  stated  that  he 
warned  senior  Facebook  executives  years  ago  that  its  lax  approach  to  data  protection  risked  a  major 
breach.  “[M]y  concerns”  he  said,  “were  that  all  of  the  data  that  left  Facebook  servers  to  developers 
could  not  be  monitored  by  Facebook,  so  we  had  no  idea  what  developers  were  doing  with  the 
data,”  Parakilas  told  the  Guardian  that  “Facebook  had  terms  of  service  and  settings  that  ‘people 
didn’t  read  or  understand’  and  the  company  did  not  use  its  enforcement  mechanisms,  including 
audits  of  external  developers,  to  ensure  data  was  not  being  misused.”  “It  has  been  painful 
watching,”  he  said,  “because  I  know  that  they  could  have  prevented  it.”17 


16  Facebook  Terms  of  Service,  January  30,  2015-present,  https://www.facebook.com/tenns.pht) 

17  https://www.theguardian.com/news/2018/mar/20/facebook-data-cambridge-  analytica-sandy-parakilas 
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32.  From  its  inception  in  2004,  Facebook  has  built  the  world’s  largest  social  media 
platform.  Facebook  now  has  over  two  billion  monthly  active  users,  with  over  200  million  in  the 
United  States  alone.  Facebook  is  now  one  of  the  world’s  leading  and  most  extensive  repositories 
of  personal  data.  The  personal  information  of  each  of  Facebook’ s  users  that  is  regularly  recorded 
and  stored  in  their  unique  Facebook  profiles  can  include:  all  manner  of  biographical  information 
(e.g.,  current  and  former  names;  alternate  names;  hometown;  birthdate;  gender;  family 
connections;  education;  email  address;  relationship  status;  education  and  work  history;  interests; 
hobbies;  religious  and  political  affiliations;  phone  number;  spoken  languages);  current  and  former 
addresses;  dates  and  times  of  active  sessions  on  Facebook;  dates  and  times  and  titles  of  any 
advertisements  that  were  “clicked”  by  the  Facebook  user;  connections  with  other  Facebook  users; 
communications  with  other  Facebook  users  through  the  integrated  Facebook  “Messenger” 
application  and  the  user  Facebook  inbox;  current  and  last  location;  attendance  at  events  and  social 
gatherings;  stored  credit  card  information  used  to  make  purchases  on  Facebook;  people  the 
Facebook  user  is  “friends”  with  or  follows;  Facebook  “groups”  of  which  the  user  is  a  member;  a 
list  of  IP  addresses  that  the  user  has  logged  into  and  out  of  his  or  her  account;  posts  or  sites  the 
user  has  “liked”;  searches  conducted  by  the  user  on  Facebook;  photographs  and  videos 
documenting  all  aspects  of  their  lives  and  the  lives  of  their  friends  and  family;  and  their  activity  in 
Facebook-connected  applications  (“User  Information”). 

33.  Facebook  has  stated  publicly  that  it  collects  substantial  additional  user  data  across 
Instagram,  Messenger  and  Whatsapp — three  other  massive  social  media/mobile  apps  it  owns.18 
Facebook  also  admitted  that  “[m]alicious  actors  have  also  abused  these  features  [referring  to 
Facebook’ s  “friend”  search  functions]  to  scrape  public  profile  information  by  submitting  phone 


https://www.cnbc.com/2018/04/04/facebook-updates-its-terms-of-service-to-  include-messenger-instagram.html. 
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numbers  or  email  addresses  they  already  have  through  search  and  account  recovery.  Given  the 
scale  and  sophistication  of  the  activity  we’ve  seen,  we  believe  most  people  on  Facebook  could 
have  had  their  public  profile  scraped  in  this  way.” 

34.  A  critical  feature  of  the  explosive  global  growth  of  Facebook  is  the  appearance  of 
control  users  have  over  their  sensitive  User  Information.  Facebook’s  privacy  settings  purport  to 
offer  users  control  over  the  dissemination  of  various  categories  of  their  User  Information,  whether 
it  be  privately  with  particular  individuals,  with  all  of  their  Facebook  friends,  with  friends  of  friends, 
or  with  all  Facebook  users.  Users  thus  reasonably  expect  User  Information  will  be  accessible  only 
to  the  extent  they  expressly  authorize  such  access.  However,  this  appearance  of  control  and 
security  is  deceptive. 

35.  The  personal  information  of  at  least  in  excess  of  80  million  Facebook  users, 
including  more  than  70  million  in  the  U.S.  and  U.K.  was,  in  fact,  outside  their  control  and  was 
accessed,  collected,  and  extracted  without  their  knowledge  and  consent.  By  allowing  broad, 
unmonitored  access  to  users’  personal  information,  Facebook  enabled  the  theft  of  users’  personal 
information  by  Defendants  GSR,  Kogan,  Cambridge,  and  SCL  Entities  and  used  such  personal 
information  to,  among  other  things,  improperly  target  users  with  advertisements  and  other 
communications  designed  and  based  upon  their  own  stolen  personal  information.  This  was  only 
achievable  by  Defendants  through  the  unauthorized  access  to  and  theft  of  the  vast  amount  of 
personal  data,  including  the  purportedly  private  communications  among  users,  collected  and 
maintained  by  Facebook.  Whistleblowers  have  reported  that  the  stolen  data  of  Facebook  users 
was  copied  and  remains  in  the  hands  of  third  parties.19  Illegal  use  of  the  stolen  personal 
information  poses  additional  far-reaching,  high-risk  implications  for  users. 

19  https://www.channel4.com/news/revealed-cambridge-analvtica-data-on-thousands-of-facebook-users-still-not- 
deleted 
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The  Misuse  of  Stolen  Facebook  Users’  Personal  Information  by 
Defendants  SCL  Entities  and  Cambridge 

36.  Cambridge  Analytica  “is  a  political  analysis  firm  that  claims  to  build  psychological 
profiles  of  voters  to  help  its  clients  win  elections.”20  According  to  its  own  website,  CA  Political 
is  “the  global  leader  in  data-driven  campaigning  with  over  25  years  of  experience,  supporting  more 
than  1 00  campaigns  across  five  continents.  Within  the  United  States  alone,  we  have  played  a 
pivotal  role  in  winning  presidential  races  as  well  as  congressional  and  state  elections.”21  On  the 
commercial  side,  CA  Commercial  claims  to  have  “revolutionized  the  relationship  between  data 
and  marketing.  We  combine  predictive  data  analytics,  behavioral  sciences,  and  innovative  ad  tech 
into  one  award-winning  approach.”22 

37.  Christopher  Wylie  is  a  former  senior  employee  of  Defendant  Cambridge  Analytica 
who  designed  “a  plan  to  harvest  the  Facebook  profiles  of  millions  of  people  in  the  U.S.,  and  to  use 
their  private  and  personal  information  to  create  sophisticated  psychological  and  political  profiles. 
And  then  target  them  with  political  ads  designed  to  work  on  their  particular  psychological 
makeup.”23 

38.  Prior  to  the  formation  of  Cambridge  Analytica,  Wylie  was  “research  director  across 
the  SCL  group,  a  private  contractor  that  has  both  defense  and  elections  operations.  Its  defense  arm 
was  a  contractor  to  the  UK’s  Ministry  of  Defence  and  the  US  Department  of  Defense,  among 
others.  Its  expertise  was  in  ‘psychological  operations’  -  or  psyops  -  changing  people’s  minds  not 
through  persuasion,  but,  instead,  through  ‘informational  dominance’,  a  set  of  techniques  that 


20  http://time.com/52053 14/facebook-cambridge-analytica-breach/ 

21  https://capolitical.com/?  hstc^l  630 1 3475. cab007272c33dbdldf48f46cdda793ba.  1522261 580046. 

1522261580046.1522860395020.2& _ hssc=163013475.1.1522860395020& _ hsfp=908707084 

22  https://cacommercial.com/?  hstc-163013475.cab007272c33dbdldf48f46cdda793ba.  152226 1580046. 

1522261580046.1522860395020.2& _ hssc=163013475.2.1522860395020& _ hsfp=908707084 

23  https://-www.theguardian.com/news/2018/mar/17/data-war-whistleblower-cMstopher-wvlie-faceook-nix-bannoii- 
trump 
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includes  rumor,  disinformation  and  fake  news.  Wylie’s  responsibilities  included  working  on 
contracts  the  SCL  Entities  had  within  the  British  government  to  conduct  counter-extremism 
operations  in  the  Middle  East,  and  with  the  US  Department  of  Defense  for  work  in  Afghanistan. 

39.  In  the  autumn  of  2013,  Wylie  met  Steve  Bannon.  Mr.  Bannon  reportedly  was  told 
that  the  SCL  entities  “do  cyberwarfare  for  elections.”24  Mr.  Bannon  reportedly  introduced  Wylie 
and  Alexander  Nix,  the  CEO  of  the  SCL  Entities,  to  Robert  and  Rebekah  Mercer  at  an  in-person 
meeting  in  New  York.  Bannon  together  with  the  SCL  Entities  created  one  or  more  of  the 
Cambridge  entities.  Investor  Robert  Mercer  reportedly  provided  $15  million  in  funding  for  these 
enterprises.  Rebekah  Mercer  was  made  President,  Mr.  Bannon  was  installed  as  Vice  President  and 
Secretary,  and  British  citizen  Alexander  Nix  became  Chief  Executive  Officer.25 

The  Stealing  of  Facebook  Data 

40.  On  or  about  June  4, 2014,  one  month  after  the  formation  of  CA  Holdings,  and  three 
years  after  entry  of  the  FTC  Consent  Order,  SCL  Entities  through  SCL  Elections  Limited, 
contracted  with  Cambridge  University  psychologist  Defendant  Aleksandr  Kogan  and  his  company 
Defendant  Global  Science  Research  (“GSR”)  to  act  as  their  agent  in  the  creation  of  an  application26 
for  use  on  Facebook  (“GSR  Application”).27,28  According  to  whistleblower  and  former  Cambridge 
employee  Christopher  Wylie,  the  purpose  of  this  undertaking  was  for  SCL  Entities  and  Cambridge 
to  gain  access  to  the  personal  information  of  both  the  users  who  used  the  application  and  the 
Friends  of  those  users.29  Specifically,  according  to  Time.com,  Mr.  Wylie  claims  that  “Cambridge 


24  Id 

25  Id. 

26  An  application  is  any  software  program  that  runs  on  a  computer,  https://techterms.com/definition/application 

27  https://www.theguardian.com/news/2018/mar/17/cambridge-analvtica-facebook-mfluence-us-election 

28  See  generally  GSR  Contract. 

29  See  Carole  Cadwalladr,  “’I  made  Steve  Bannon’s  psychological  warfare  tool:’  meet  the  data  war  whistleblower,” 
The  Guardian  (March  18,  2018),  https://www.theguardian.com/news/2018/mar/17/data-war-whistleblower- 
christopher-wvlie-facebook-nix-baiinon-trump  (“Cadwalladr  Article”) 
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Analytical  goal  was  to  establish  profiling  algorithms  that  would  ‘allow  us  to  explore  mental 
vulnerabilities  of  people,  then  map  out  ways  to  inject  information  into  different  streams  or  channels 
of  content  online  so  that  people  started  to  see  things  all  over  the  place  that  may  or  may  not  have 
been  true.”’30 

41 .  As  reported  in  The  Washington  Post,  Mr.  Wylie  also  states  that  this  undertaking  by 
SCL  Entities  and  Cambridge  was  “part  of  a  high-tech  form  of  voter  persuasion  touted  by 
[Cambridge],  which  under  Bannon  identified  and  tested  the  power  of  anti-establishment 
messages....”31  The  Washington  Post  also  reported  that,  according  to  Mr.  Wylie,  Mr.  Bannon,  as 
a  top  executive  of  Cambridge  Analytica  at  the  time  of  the  data  breach  in  2014,  “was  deeply 
involved  in  the  company’s  strategy  and  approved  spending  nearly  $1  million  to  acquire  data, 
including  Facebook  profiles,  in  20 14.”32 

42.  Facebook  was  chosen  for  several  reasons.  First,  the  fact  that  Facebook’s  existing 
developer  tools  provided  application  developers  with  expansive  access  to  both  users  and  their 
Friends  was  an  “open  secret”  well  known  to  developers,33  as  well  as  GSR,  Kogan,  SCL  Entities, 
and  Cambridge.34 

43.  Second,  Facebook’s  Software  Development  Kit  (“SDK”)  allowed  third  party 
developers  to  add  Facebook-related  features  to  their  websites  or  services.35  These  features 
permitted  the  developer’s  service  to  interact  with  Facebook  in  various  ways.  Among  the  features 


30  http://time.com/52053 14/facebook-cambridge-analytica-breach/ 

31  https://www.washingtonpost.com/politics/bannon-oversaw-cambridge-analyticas-collection-of-facebook-data- 
according-to-former-employee/20 1 8/03/20/8fb369a6-2c55-lle8-b0b0- 
f706877db618_story.html?utm_term=.9eef8f641a98 

32  Id. 

33  See,  e.g.,  Emil  Protalinski,  Stalkbook:  Stalk  Anyone,  Even  If  You  're  Not  Facebook  Friends ,  CNET  (July  23, 
2012),  https://www.cnet.com/news/stalkbook-stalk-anvone-even-if-voure-not-facebook-ffiends/. 

34  See  GSR  Contract,  at  Schedule  2. 

35  An  SDK  generally  refers  to  a  set  of  software  development  tools  that  allow  programmers  to  develop  applications 
that  interface  with  a  specific  software  platform.  Here,  Facebook’s  SDK  allows  Facebook  to  release  code  for  third 
party  developers  to  use  in  order  to  interact  with  Facebook’s  platform. 
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relevant  to  this  case  is  the  ability  to  include  a  “Facebook  Login,”  which  let  visitors  login  to  a 
website  using  their  Facebook  credentials. 

44.  When  an  individual  visits  or  accesses  a  service  utilizing  Facebook’s  SDK, 
information  about  the  individual’s  online  activities  are  transmitted  back  to  Facebook.  Facebook 
benefits  from  this  additional  information  about  its  users,  and  the  application  developer  benefits 
because  users  can  quickly  sign  in  using  their  Facebook  account. 

45.  Third,  Facebook  is  one  of  the  largest  data  mining  companies  in  the  world,  collecting 
data  from  over  200  million  users  just  in  the  United  States.36  With  this  data,  Facebook  is  uniquely 
able  to  provide  a  holistic  picture  of  a  user’s  online  and  offline  behaviors  by  linking  all  of  the  data 
it  collects  on  a  user’s  digital  conduct  with  the  personal  information  it  extracts  from  the  user’s 
profile  and  activities.37 

46.  In  the  second  half  of  2014,  in  order  to  incentivize  users  to  download  and  access  the 
GSR  Application  they  had  developed,  SCL  Entities  and  Cambridge,  through  their  agents  Kogan 
and  GSR,  posed  as  an  academic  researcher  seeking  information  through  a  personality  quiz.  Kogan 
“advertised  for  people  who  were  willing  to  be  paid  to  take  a  personality  quiz  on  Amazon’s 
Mechanical  Turk  and  Qualtrics.38  At  the  end  of  which,  users  gave  Kogan’s  GSR  Application, 
called  thisisyourdigitallife,  permission  to  access  each  participant’s  Facebook  profiles.”39  Kogan’s 
GSR  Application  used  Facebook’s  SDK  Facebook  Login,  meaning  that  users  who  wanted  to  take 


36  Kurt  W agner  &  Rani  Molla,  Facebook  Is  Not  Getting  Any  Bigger  In  The  United  States,  RECODE  (March  1 ,  20 1 8), 
https://www. recode  net/201 8/3/1/17063208/facebook-us-growth-pew-research-users  (“More  than  two-thirds  of 
Americans”  use  Facebook). 

37  Nathan  Ingraham,  Facebook  Buys  Data  On  Users  ’  Offline  Habits  For  Better  Ads,  ENDGAGET  (December  30, 
2016),  https://www.engadget.com/2016/12/30/facebook-buvs-data-on-users-offline-habits-for-better-ads/:  Cade 
Metz,  How  Facebook  Knows  HAien  Its  Ads  Influence  Your  Offline  Purchases,  WIRED  (December  1 1,  2014), 
https://www.wired.com/2014/12/facebook-knows-ads-influence-offline-purchases/. 

38  Mechanical  Turk  is  an  online  marketplace  where  people  around  the  world  contract  with  others  to  perform  various 
tasks. 

39  See  Cadwalladr  Article. 
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the  personality  quiz  had  to  use  their  Facebook  Login  credentials  to  access  the  quiz,  thus  giving  the 
developers  of  the  quiz  application  access  to  the  users’  Facebook  information. 

47.  Once  the  GSR  Application  was  granted  access  to  the  profiles  and  extracting 
personal  information  of  the  users,  GSR  and  Kogan,  working  on  behalf  of  SCL  Entities  and 
Cambridge,  and  as  an  agent  of  SCL  Entities  and  Cambridge,  were  able  to  capitalize  on  Facebook’ s 
knowing  and  willful  negligence  by  accessing  the  profiles  and  extracting  personal  information  of 
all  or  virtual  ly  all  of  the  Friends  of  the  users  who  participated  in  the  GSR  Application  personality 
quiz. 


48.  Facebook  became  aware  of  the  data  extraction  when  security  protocols  were 
triggered  by  the  massive  data  download  from  the  GSR  Application.  According  to  Facebook,  when 
Facebook  investigated  the  extraction,  GSR  and  Kogan  told  Facebook  the  data  was  to  be  used  for 
“academic  purposes;”  Facebook  negligently  and  without  verification,  accepted  this  representation 
and  allowed  the  data  extraction  to  continue.40  Specifically,  according  to  Facebook,  it  was  told  by 
GSR  and  Kogan,  that 

This  app  is  part  of  a  research  program  in  the  Department  of  Psychology  at  the 
University  of  Cambridge.  We  are  using  this  app  for  research  purposes  -  learning 
about  how  people’s  Facebook  behavior  can  be  used  to  better  understand  their 
psychological  traits,  well-being,  health,  etc  and  overcome  classic  problems  in  social 
science.  Users  of  the  app  will  be  presented  with  a  description  of  the  types  of  data 
we  gather  and  the  scientific  purpose  of  the  data.  Users  will  be  informed  that  the 
data  will  be  carefully  protected  and  never  used  for  commercial  purposes.41 

49.  Facebook  claims  that  the  first  time  it  learned  that  the  data  extraction  had  not  been 
for  academic  use  was  later  in  time:  when  the  Guardian  published  its  report  about  the  SCL  Entities 


40  Chloe  Aiello,  Developer  Behind  The  App  At  The  Center  Of  Data  Scandal  Disputes  Facebook 's  Story,  CNBC 
(March  2 1 ,  20 1 8),  https://www.cnbc.com/20 1 8/03/21  /aleksander-kogan-facebook-shouldve-known-how-app-data- 
was-being-used  html. 

41  Id. 
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and  Cambridge  acquiring  and  utilizing  the  extracted  Facebook  data  in  December  20 15. 42  However, 
even  when  faced  with  the  possibility  of  such  a  violation  of  its  policies  in  December  of  2015, 
Facebook  negligently  failed  to  take  any  remedial  action  and  waited  for  several  months,  until 
August  of  2016,  before  taking  any  action.  Even  then  all  that  Facebook  did  was  send  Cambridge  a 
letter.43  In  August  2016,  Facebook  wrote  to  Christopher  Wylie,  who  had  left  Cambridge  in  2014, 
informing  him  “that  the  data  had  been  illicitly  obtained  and  that  ‘[Kogan’s  company]  was  not 
authorized  to  share  or  sell  it,’  stating  that  the  extracted  data  must  be  deleted  immediately.44’45 

50.  According  to  Wylie,  by  August  of  2016,  there  were  multiple  copies  of  the  extracted 
data,  and  that  it  had  been  emailed  to  a  number  of  recipients  unencrypted.  He  states  that  Facebook 
made  no  efforts  thereafter  to  either  retrieve  the  extracted  data  or  confirm  that  he,  or  any  other 
recipient,  had  deleted  it.46 

51.  While  GSR,  Kogan,  SCL  Entities  and  Cambridge  now  claim  that  they  “clearly 
stated  that  users  were  granting  us  the  right  to  use  the  data  in  broad  scope,  including  selling  and 
licensing  data...”47,  the  contemporaneous  written  statements  in  the  letter  sent  to  Facebook  is 
directly  contrary  to  this  purported  representation. 

52.  While  a  Facebook  spokesperson  made  an  unsupported,  contradictory  statement  that 
“[b]oth  Aleksandr  Kogan  as  well  as  the  SCL  Group  and  [Cambridge]  certified  to  us  that  they 
destroyed  the  data  in  question,”  Mark  Zuckerberg,  Facebook’ s  CEO,  admitted  that  “[tjhis  was  a 
major  breach  of  trust,  and  I’m  really  sorry  this  happened.  You  know,  we  have  a  basic  responsibility 


42  Ben  Jacobs,  Ted  Cruz  using  firm  that  harvested  data  on  millions  of  unwitting  Facebook  users,”  The  Guardian 
(December  11,  2015),  https://www.theguardian.eom/us-news/2015/dec/l  1/senator-ted-cruz-president-campaign- 
facebook-user-data. 

43  Id. 

44  Cadwalladr  Article 

45  See  Letter  from  Facebook  to  C.  Wylie,  attached  hereto  as  Exhibit  2  (“Facebook  Letter”). 

46  Id 

47  Id 
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to  protect  people ’s  data  and  if  we  can  7  do  that  then  we  don  7  deserve  to  have  the  opportunity  to 
serve  people.  ”48 

53.  This  admission  by  Mr.  Zuckerberg  acknowledges  that  Facebook  knew  it  had  a  clear 
duty  to  protect  the  personal  information  of  its  users,  and  in  fact,  had  a  clear  duty  to  protect  the 
personal  information  of  its  users,  and  that  it  breached  that  duty  in  several  ways,  including;  its 
failure  to  prevent  the  unauthorized  extraction  of  information  from  occurring  by  correcting  and 
eliminating  a  known  weakness  in  its  developer  platform;  its  failure  to  use  the  means  it  had  to 
adequately  protect  the  information;  its  failure  to  retrieve  the  information  immediately  upon 
discovery  of  its  unauthorized  extraction;  and  its  failure  to  inform  Facebook  users  in  a  timely 
manner. 

54.  Moreover,  Mr.  Zuckerberg’s  admission  that  Facebook  breached  its  duties  is 
confirmed  by  a  review  of  Facebook’ s  policies  in  place  at  the  time.  Specifically,  Facebook’s  “Data 
Use  Policy,”  effective  at  the  time  that  GSR,  Kogan,  SCL  Entities,  and  Cambridge  accessed  and 
extracted  the  data,  states  in  part: 

How  we  use  the  information  we  receive:  We  use  the  information  we  receive  about 
you  in  connection  with  the  services  and  features  we  provide  to  you  and  other  users 
like  your  friends,  our  partners,  the  advertisers  that  purchase  ads  on  the  site,  and  the 
developers  that  build  the  games,  applications,  and  websites  you  use.  For  example, 
in  addition  to  helping  people  see  and  find  things  that  you  do  and  share,  we  may  use 
the  information  we  receive  about  you: 

•  as  part  of  our  efforts  to  keep  Facebook  products,  services  and  integrations 
safe  and  secure; 

•  to  protect  Facebook ’s  or  others  ’  rights  or  property; 

•  to  provide  you  with  location  features  and  services,  like  telling  you  and  your 
friends  when  something  is  going  on  nearby; 

•  to  measure  and  understand  the  effectiveness  of  ads  you  and  others  see, 
including  to  deliver  relevant  ads  to  you; 

•  to  make  suggestions  to  you  and  other  users  on  Facebook,  such  as: 
suggesting  that  your  friend  use  our  contact  importer  because  you  found 


48  See  Danielle  Wiener-Bronner,  “Mark  Zuckerberg  has  regrets:  ‘I’m  sorry  that  this  happened’”  CNN  (March  21, 
2018),  http://monev.cnn.com/2018/03/21/technology/mark-zuckerberg-apologv/index.html. 
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friends  using  it,  suggesting  that  another  user  add  you  as  a  friend  because  the 
user  imported  the  same  email  address  as  you  did,  or  suggesting  that  your 
friend  tag  you  in  a  picture  they  have  uploaded  with  you  in  it;  and 

•  for  internal  operations,  including  troubleshooting,  data  analysis,  testing, 
research  and  service  improvement,  (emphasis  added)49 

55.  Facebook’s  “Data  Use  Policy”  also  stated: 

While  you  are  allowing  us  to  use  the  information  we  receive  about  you,  you  always 

own  all  of  your  information.  Your  trust  is  important  to  us,  which  is  why  we  don’t 

share  information  we  receive  about  you  with  others  unless  we  have: 

•  received  your  permission; 

•  given  you  notice,  such  as  by  telling  you  about  it  in  this  policy;  or 

•  removed  your  name  and  any  other  personally  identifying  information  from 
it.  (emphasis  added).50 

56.  The  Federal  Trade  Commission  issued  guidance  on  how  to  appropriately  respond 
to  data  breaches,  entitled  “Data  Breach  Response:  A  Guide  for  Business,”  in  which  it  advises, 
“When  your  business  experiences  a  data  breach,  notify  law  enforcement,  other  affected  businesses, 
and  affected  individuals.”51  Facebook  failed  to  follow  this  FTC  guidance  once  it  was  released, 
instead  choosing  to  keep  this  massive  data  breach  by  Cambridge  a  secret  from  its  affected  users 
until  it  was  forced  to  admit  that  the  breach  had  occurred,  and  only  when  it  was  made  public  by 
third  parties. 

57.  Several  things  are  clear.  First,  GSR,  Kogan,  SCL  Entities,  and  Cambridge,  either 
directly  or  through  their  affiliated  corporate  entities  and/or  agents,  mislead  Facebook  regarding 
their  true  purposes  and  goals  behind  the  development  and  execution  of  the  thisisyourdigitallife 
GSR  Application. 

58.  Second,  GSR,  Kogan,  SCL  Entities  and  Cambridge,  either  directly  or  through  their 
affiliated  corporate  entities  and/or  agents,  did  not  disclose  to  Facebook  that  they  were  using  and/or 


49  Data  Use  Policy,  Facebook,  Inc.  (Date  of  Last  Revision:  November  15,  2013), 
https://www.facebook.com/fuli  data  use  policy. 

50  Id. 

51  Federal  Trade  Commission,  “Data  Breach  Response:  A  Guide  for  Business”  (2016) 
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had  used  the  GSR  Application  as  a  vehicle,  through  the  voluntary  participants  who  they 
incentivized  to  take  the  quiz,  to  improperly  gain  access  to,  collect  and  extract  the  personal 
information  from  approximately  71.6  million  Facebook  users  who  did  not  access  the  GSR 
Application  or  otherwise  consent  to  such  an  intrusion,  theft  and  use. 

59.  Third,  Facebook  negligently  failed  to  properly  inquire  or  investigate  what 
information  GSR,  Kogan,  SCL  Entities  and/or  Cambridge  were  accessing,  collecting,  and 
extracting. 

60.  Fourth,  Facebook  knowingly  failed  to  take  action  to  eliminate  a  “backdoor”  that 
allowed  applications  created  using  its  developer  platform  to  be  portals  through  which  third  parties 
have  obtained  widescale,  unauthorized  access  to  the  information  of  tens  of  millions  of  Facebook 
users. 

61.  Fifth,  Facebook  knowingly  failed  to  comply  with  its  obligations  as  set  forth  on  its 
website  and  provided  to  each  of  its  Facebook  users. 

62.  Sixth,  Facebook  negligently  failed  to  adequately  protect  its  users’  information 
contrary  to  its  obligations  set  forth  the  2011  Consent  Order  entered  into  between  Facebook  and 
the  FTC,  discussed  infra. 

63.  Seventh,  Facebook,  upon  learning  of  the  unauthorized  extraction  of  users’ 
information  and  Cambridge’s  gross  invasion  of  privacy,  withheld  from  its  users  knowledge  of  that 
wrongdoing,  as  well  as  knowingly  and/or  negligently  refusing  to  take  adequate  steps  to  ensure  the 
return  and/or  destruction  of  the  stolen  information. 

2011  FTC  Investigation  of  Facebook 

64.  Prior  to  GSR’s,  Kogan’s,  SCL  Entities’  and  Cambridge’s  development  and 
execution  of  the  thisisyourdigitallife  application,  in  2011,  as  a  result  of  an  investigation,  the 
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Federal  Trade  Commission  prepared  a  draft  complaint  against  Facebook,  alleging  violations  of  the 
Federal  Trade  Commission  Act.  Specifically,  the  FTC  alleged,  inter  alia ,  that  Facebook’ s  platform 
allowed  third  parties  to  “develop,  run,  operate  software  applications,  such  as  games,  that  users  can 
interact  with  online  (“Platform  Applications”).”52 

65.  According  to  the  FTC,  these  Platform  Applications  enabled  access  to  a  user’s 
personal  information  in  one  of  two  ways;  (a)  if  the  user  authorized  the  access  directly;  or  (b)  if  a 
user’s  Facebook  Friend  authorizes  the  Platform  Application.  In  the  latter  case,  the  Platform 
Application  gains  access  to  at  least  some  of  a  Facebook  user’s  information  even  though  the  user 
has  not  authorized  the  Platform  Application  to  do  so.53 

66.  Further,  the  FTC  alleged  that,  despite  whatever  Facebook  privacy  settings  a  user 
selected,  “a  user’s  choice  to  restrict  profile  information  to  “Only  Friends,”  or  “Friends  of  Friends” 
would  be  ineffective  as  to  certain  third  parties.”54  In  fact,  “Facebook  has  made  profile  information 
that  a  user  chose  to  restrict  to  “Only  Friends”  or  “Friends  of  Friends”  accessible  to  any  Platform 
Applications  that  the  user’s  Friends  may  have  used  (“Friends’  Apps”).55 

67.  The  FTC  acknowledged  that  it  was  possible  for  a  user  to  click  on  a  link  for 
“Applications,”  “Apps,”  or  “Applications  and  Websites”  in  order  to  reach  a  different  page 
containing  “Friends’  App  Settings,”  which  would  allow  users  to  restrict  the  information  that  a 
Friends’.  App  could  access.  But  it  is  also  alleged  that  “in  many  instances,  the  links  to 
“Applications,”  “Apps,”  or  “Applications  and  Websites”  have  failed  to  disclose  that  a  user’s 
choices  made  through  Profile  Privacy  Settings  have  been  ineffective  against  Friends’  Apps.  For 


52  In  the  Matter  of  Facebook,  Inc.,  a  corporation,  U.S.  Federal  Trade  Commission  Complaint  (“FTC  Complaint”),  at 
14. 

53  Id.,  at  TI 9. 

54 Id,  atf  14. 

55  Id 
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example,  the  language  alongside  the  Applications  link  ...  has  stated  ‘[cjontrol  what  information  is 
available  to  applications  you  use  on  Facebook.”  (emphasis  added)56 

68.  The  FTC  asserted  that  Facebook’ s  representation  that  “through  their  Profile  Privacy 
Settings,  users  can  restrict  access  to  their  profile  information  to  specific  groups,  such  as  “Only 
Friends”  or  “Friends  of  Friends”  was  false  or  misleading.57 

69.  Privacy  concerns  were  not  a  new  phenomenon  to  Facebook.  On  December  8, 2009, 
Facebook  started  to  implement  a  new  privacy  policy  which  designated  certain  user  information  as 
“publicly  available,”  including  their  name,  profile  picture,  gender,  Friend  list,  pages,  and  networks. 
Facebook’ s  implementation  prevented  users  from  restricting  access  to  this  information  through 
their  Profile  Privacy  Settings,  and  all  of  their  prior  privacy  settings  relating  to  this  information 
were  overridden.58 

70.  In  Count  3  of  its  Complaint,  the  FTC  asserted  that  “Facebook  materially  changed 
its  promises  that  users  could  keep  such  information  private.  Facebook  retroactively  applied  these 
changes  to  personal  information  that  it  had  previously  collected  from  users,  without  their  informed 
consent,  in  a  manner  that  has  caused  or  has  been  likely  to  cause  substantial  injury  to 
consumers....”59  Therefore,  the  FTC  has  recognized  that  there  is  an  inherent  or  intrinsic  value 
associated  with  the  ability  to  control  who  has  access  to  certain  kinds  of  personal  information,  and 
that  the  unauthorized  access  and/or  use  of  such  information  causes  substantial  injury  to  the 
individual  whose  information  is  improperly  revealed  and/or  used. 

71.  In  Count  4,  the  FTC  charged  that  Facebook  made  repeated  public  statements  to  the 
effect  that  the  scope  of  Platform  Applications’  access  to  a  user’s  data  was  limited  to  only  that 


56  Id  at  If  15-16. 

51  Id.  at  Count  1,  H  17-18. 

58  Id.  at  11 19-22. 

59  Mat  Count  3,f  29. 
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information  needed  for  the  application  to  work  or  operate.  Contrary  to  these  statements,  however, 
“from  approximately  May  2007  until  July  2010,  in  many  instances,  Facebook  has  provided 
Platform  Applications  unrestricted  access  to  user  profile  information  that  such  Applications  have 
not  needed  to  operate,”  rendering  Facebook’s  statements,  “false  and  misleading 
representation  [s]  .”60 

72.  In  response  to  the  FTC’s  investigation  and  to  resolve  the  serious  issues  raised  by 
the  FTC’s  Complaint,  Facebook  entered  into  the  FTC  Consent  Order  on  or  about  November  29, 
2011.61 

73.  The  FTC  Consent  Order  contained  a  requirement  prohibiting  Facebook  from 
making  any  misrepresentations  about  several  topics,  including  “its  collection  or  disclosure  of  any 
covered  information;”  “the  extent  to  which  a  consumer  can  control  the  privacy  of  any  covered 
information  maintained  by  [Facebook];”  “the  extent  to  which  [Facebook]  makes  or  has  made 
covered  information  accessible  to  third  parties;”  and  “the  steps  [Facebook]  takes  or  has  taken  to 
verify  the  privacy  or  security  protections  that  any  third  party  provides. .  ..”62 

74.  However,  more  relevant  here,  are  the  FTC  Consent  Order’s  requirements  related  to 
Facebook’s  sharing  of  a  user’s  nonpublic  information.  Specifically,  the  FTC  ordered,  and 
Facebook  agreed,  that: 

It  is  Further  Ordered  that  [Facebook]  and  its  representatives,  in  connection  with  any 
product  or  service,  in  or  affecting  commerce,  prior  to  any  sharing  of  a  user’s 
nonpublic  user  information  by  [Facebook]  with  any  third  party,  which  materially 
exceeds  the  restrictions  imposed  by  a  user’s  privacy  setting(s),  shall:  (A)  clearly 
and  prominently  disclose  to  the  user,  separate  and  apart  from  any  “privacy  policy,” 

“data  use  policy,”  “statement  of  rights  and  responsibilities”  page,  or  other  similar 
document:  (1)  the  categories  of  nonpublic  user  information  that  will  be  disclosed 
to  such  third  parties,  (2)  the  identity  or  specific  categories  of  such  third  parties,  and 


50  Id.  at  UK  30-33. 

61  See,  generally,  FTC  Consent  Order. 

62  FTC  Consent  Order,  at  Section  I.A.D. 
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(3)  that  such  sharing  exceeds  the  restrictions  imposed  by  the  privacy  setting(s)  in 
effect  for  the  user;  and  (B)  obtain  the  user’s  affirmative  express  consent.63 

75.  Therefore,  no  later  than  November  2011,  Facebook  was  aware  that  third  parties 
could  access  the  personal  information  of  users  through  applications  on  Facebook  in  which  users 
themselves  had  not  participated.  Such  access,  collection,  and  extraction  of  personal  information 
was  available  so  long  as  any  one  of  a  multitude  of  a  user’s  Friends  had  participated  in  the 
application.  The  fact  that  Facebook’s  existing  developer  tools  provided  such  access  was  an  open 
secret  well  known  to  developers.64  Further,  Facebook  was  aware  that  providing  such  unauthorized 
access  to  a  user’s  personal  information  would  cause  that  user  substantial  injury. 

76.  Despite  this  knowledge  and  its  obligations  to  its  users,  Facebook  took  no 
affirmative  action,  and,  thereby,  refused  or  otherwise  failed  to  fix,  change,  or  otherwise  remedy 
this  known  defect  in  its  existing  developer  tools.  As  a  result,  GSR  and  Aleksandr  Kogan,  working 
with  SCL  Entities  and  Cambridge,  were  able  to  utilize  this  defect  and  capitalize  on  this 
unauthorized  access  through  the  use  of  the  thisisyourdigitallife  GSR  Application.  As  described 
above,  approximately  270,000  U.S.  Facebook  users  installed  and  participated  in  the  GSR 
Application,  providing  GSR,  Kogan,  the  SCL  Entities,  and  Cambridge  access,  not  only  to  the 
personal  information  of  those  270,000  participants,  but  also  unauthorized  access  to  the  theft  of  the 
personal  information  of  approximately  71.6  million  U.S.  Facebook  users  who  were  Friends  of  the 
270,000  participants,  causing  substantial  injury  to  the  71.6  million  individuals. 


63  Id.  at  Section  II. A.  and  II.B. 

64  See,  e.g. ,  Emil  Protalinski,  Stalkbook:  Stalk  Anyone,  Even  If  You  're  Not  Facebook  Friends,  CNET  (July  23, 
2012),  https://www.cnet.com/news/stalkbook-stalk-anvone-even-if-voure-not-facebook-friends/. 
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CLASS  ACTION  ALLEGATIONS 

77.  Pursuant  to  Rule  23(b)(2)  and  (b)(3)  of  the  Federal  Rules  of  Civil  Procedure, 

Plaintiffs,  individually  and  on  behalf  of  all  others  similarly  situated,  bring  this  lawsuit  on  behalf 

of  themselves  and  as  a  class  action  on  behalf  of  the  following  class: 

All  natural  persons  who  registered  for  Facebook  accounts  in  the  United  States  or  the 
United  Kingdom,  who  did  not  utilize,  download,  or  otherwise  access  the  yourdigitallife 
GSR  Application  and  whose  Personal  Information  was  obtained  from  Facebook  by 
Defendants  GSR,  Kogan,  SCL  Entities  and/or  Cambridge,  either  directly  or  indirectly, 
without  authorization  or  in  excess  of  authorization. 

78.  Excluded  from  the  Class  are  any  entities,  including  Defendants,  and  Defendants’ 
officers,  agents,  and  employees.  Also  excluded  from  the  Class  are  counsel  for  Plaintiffs,  the  judge 
assigned  to  this  action,  and  any  member  of  the  judge’s  immediate  family. 

A.  Numerosity 

79.  The  first  requirement  of  Rule  23(a)  is  met  when  “the  class  is  so  numerous  that 
joinder  of  all  members  is  impractical.”  Fed.  R.  Civ.  P.  23(a)(1).  Generally,  the  numerosity 
requirement  is  met  when  the  class  comprises  40  or  more  members.  Hayes  v.  Wal-Mart  Stores,  Inc. , 
725  F.3d  349,  357  n.5  (3d  Cir.  2013);  Nat’l  Fed’n  of  the  Blind  v.  Target  Corp.,  582  F.  Supp.  2d 
1185,  1199  (N.D.  Cal.  2007)  (“As  a  general  rule,  classes  numbering  greater  than  41  individuals 
satisfy  the  numerosity  requirement.”).  Numerosity  in  this  case  is  easily  satisfied.  The  members  of 
the  Class  are  so  numerous  that  joinder  of  all  members  of  any  Class  would  be  impracticable. 
Plaintiffs  reasonably  believe  that  Class  members  number  seventy-one  point  six  (71.6)  million 
people  or  more  in  the  aggregate.  The  names  and  addresses  of  Class  members  are  identifiable 
through  documents  maintained  by  Defendants. 
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B.  Commonality  and  Predominance 

80.  Rule  23(a)(2)  requires  that  “there  are  questions  of  law  or  fact  common  to  the  class.” 
To  meet  the  commonality  requirement,  Plaintiffs  must  demonstrate  that  the  proposed  class 
members  “have  suffered  the  same  injury.”  Wal-Mart  Stores,  Inc.  v.  Dukes ,  131  S.  Ct.  2541,  2551 
(2011)  (quoting  Gen.  Tel.  Co.  of  Sw.  v.  Falcon,  457  U.S.  147,  157  (1982)).  In  other  words, 
commonality  requires  that  the  claims  of  the  class  “depend  on  a  common  contend  on...  of  such  a 
nature  that  it  is  capable  of  class-wide  resolution  -  which  means  that  determination  of  its  truth  or 
falsity  will  resolve  an  issue  that  is  central  to  the  validity  of  each  one  of  the  claims  in  one  stroke.” 
Id.  Commonality  may  be  shown  when  the  claims  of  all  class  members  “depend  upon  a  common 
contention”  and  “even  a  single  common  question  will  do.”  Dukes,  131  S.  Ct.  at  2545,  2556.  This 
action  involves  common  questions  of  law  or  fact,  which  predominate  over  any  questions  affecting 
individual  Class  members,  including: 

a.  Whether  Facebook  represented  that  it  would  safeguard  Plaintiffs’  and  Class  Members’ 
Personal  Information  and  not  disclose  it  without  consent; 

b.  Whether  GSR,  Kogan,  SCL  Entities  and  Cambridge  Defendants  and/or  their  agents 
improperly  obtained  Plaintiffs’  and  Class  Members’  Personal  Information  without 
authorization  or  in  excess  of  any  authorization; 

c.  Whether  Facebook  was  aware  of  GSR’s,  Kogan’s,  SCL  Entities’  and  Cambridge 
Defendants’  and/or  their  agents’  improper  access  to,  collection  of,  and  extraction  of 
Plaintiffs’  and  Class  Members’  Personal  Information; 

d.  Whether  Facebook  owed  a  legal  duty  to  Plaintiffs  and  the  Class  to  exercise  due  care  in 
collecting,  storing,  safeguarding,  obtaining,  and/or  providing  access  to  their  Personal 
Information; 
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e.  Whether  Facebook  breached  a  legal  duty  to  Plaintiff  and  the  Class  to  exercise  due  care  in 
collecting,  storing,  safeguarding,  and/or  obtaining  their  Personal  Information; 

f.  Whether  Class  Members’  Personal  Information  was  improperly  and/or  illegally  obtained 
by  GSR,  Kogan,  SCL  Entities  and  Cambridge  Defendants  and/or  their  agents; 

g.  Whether  Defendants’  conduct  violated  the  SCA,  18  U.S.C.  §§  2701,  et  seq.; 

h.  Whether  Plaintiffs  and  the  Class  are  entitled  to  equitable  relief,  including,  but  not  limited 
to,  injunctive  relief,  restitution,  and  disgorgement;  and 

i.  Whether  Plaintiffs  and  the  other  Class  Members  are  entitled  to  actual,  statutory, 
consequential,  punitive  or  other  forms  of  damages,  and  other  monetary  relief. 

81.  Defendants  engaged  in  a  common  course  of  conduct  giving  rise  to  the  legal  rights 
sought  to  be  enforced  by  Plaintiffs  individually  and  on  behalf  of  the  Members  of  the  Class.  Similar 
or  identical  statutory  and  common  law  violations,  business  practices,  and  injuries  are  involved. 
Individual  questions,  if  any,  pale  by  comparison,  in  both  quantity  and  quality,  to  the  numerous 
common  questions  that  dominate  this  action. 

C.  Typicality 

82.  Typicality  requires  that  Plaintiffs’  claims  be  typical  of  other  Class  Members.  Fed. 
R.  Civ.  P.  23(a)(3).  While  the  typicality  inquiry  focuses  on  the  similarity  between  the  named 
Plaintiffs’  legal  and  remedial  theories  and  the  theories  of  those  whom  they  purport  to  represent,  it 
does  not  require  that  all  Class  Members  have  identical  claims.  In  re  Yahoo  Mail  Litig.,  308  F.R.D. 
577, 593  (N.D.  Cal.  2015);  Grossmann  v.  First  Pennsylvania  Corp.,  1991  U.S.  Dist.  LEXIS  15373, 
*9  (E.D.  Pa.  Oct.  23,  1991).  The  purpose  of  the  typicality  requirement  is  to  ensure  that  the  Class 
Representatives’  interests  are  “sufficiently  similar  to  the  rest  of  the  class  -  in  terms  of  their  legal 
claims,  factual  circumstances,  and  stake  in  the  litigation  -  so  that  certifying  those  individuals  to 
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represent  the  class  will  be  fair  to  the  rest  of  the  proposed  class.”  In  re  Schering  Plough  Corp. 
ERISA  Litig.,  589  F.3d  585,  597  (3rd  Cir.  2009);  In  re  Yahoo  Mail  Litig.,  308  F.R.D.  at  593 
(“Typicality  is  satisfied  ‘when  each  class  member’s  claim  arises  from  the  same  course  of  events, 
and  each  class  member  makes  similar  legal  arguments  to  prove  the  defendants’  liability.’”) 
(quoting  Rodriguez  v.  Hayes,  591  F.3d  1105,  1124  (9th  Cir.  2010).).  See,  e.g.,  Neal  v.  Casey,  43 
F.3d  48,  58  (3rd  Cir.  1994)  (noting  that  “cases  that  challenge  the  same  unlawful  conduct  which 
affects  both  the  named  plaintiffs  and  the  putative  class  usually  satisfy  the  typicality  requirement 
irrespective  of  the  varying  fact  patterns  underlying  the  individual  claims.”) 

83.  Plaintiffs’  claims  are  typical  of  the  claims  of  the  other  members  of  the  Class 
because,  among  other  things,  Plaintiffs  and  the  other  Class  Members  were  injured  through  the 
substantially  uniform  misconduct  by  Defendants.  Plaintiffs  are  advancing  the  same  claims  and 
legal  theories  on  behalf  of  themselves  and  all  other  Class  Members,  and  there  are  no  defenses  that 
are  unique  to  Plaintiffs.  The  claims  of  Plaintiffs  and  those  of  other  Class  Members  arise  from  the 
same  operative  facts  and  are  based  on  the  same  legal  theories. 

D.  Adequacy  of  Representation 

84.  Rule  23(a)  requires  that  the  representative  parties  have  and  will  continue  to  “fairly 
and  adequately  protect  the  interests  of  the  class.”  Fed.  R.  Civ.  P.  23(a)(4).  Both  the  Ninth  and  Third 
Circuits  have  adopted  a  two-part  test  for  this  element,  requiring  both  that  “(a)  the  plaintiffs 
attorney  must  be  qualified,  experienced,  and  generally  able  to  conduct  the  proposed  litigation,  and 
(b)  the  plaintiff  must  not  have  interests  antagonistic  to  those  of  the  class.”  Wetzel  v.  Liberty  Mutual 
Ins.  Co.,  508  F.2d  239,  247  (3rd  Cir.  1975),  cert,  denied,  421  U.S.  1011  (1975);  see  also  Hanlon 
v.  Chrysler  Corp.,  150  F.3d  1011,  1020  (9th  Cir.  1998);  In  re  Juniper  Networks  Sec.  Litig.,  264 
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F.R.D.  584,  590  (N.D.  Cal.  2009);  Cristiano  v.  Courts  of  Justices  of  the  Peace,  115  F.R.D.  240, 
248  (D.  Del.  1987). 

85.  Plaintiffs  are  adequate  representatives  of  the  class  because  their  interests  do  not 
conflict  with  the  interests  of  the  other  Class  Members  they  seek  to  represent;  they  have  retained 
counsel  competent  and  experienced  in  complex  class  action  litigation  and  Plaintiffs  will  prosecute 
this  action  vigorously.  The  Class  Members’  interests  will  be  fairly  and  adequately  protected  by 
Plaintiffs  and  their  counsel. 

E.  Superiority  and  Predominance 

86.  A  class  action  may  be  maintained  under  Rule  23(b)(3)  if  all  Rule  23(a)  requirements 
are  met  and  “the  court  finds  that  the  questions  of  law  or  fact  common  to  class  members 
predominate  over  any  questions  affecting  only  individual  members,  and  that  a  class  action  is 
superior  to  other  available  methods  for  fairly  and  efficiently  adjudicating  the  controversy.”63  See 
Amchem  Prods.,  Inc.  v.  Windsor,  521  U.S.  591,  615-616  (1997)  (addressing  predominance  and 
superiority  requirements).  The  predominance  inquiry  “tests  whether  proposed  classes  are 
sufficiently  cohesive  to  warrant  adjudication  by  representation.”  Id.  at  623. 

87.  The  superiority  requirement  “asks  the  court  to  balance,  in  terms  of  fairness  and 
efficiency,  the  merits  of  a  class  action  against  those  of  alternative  available  methods  of 
adjudication.”  In  re  NFL  Players  Concussion  Injury  Litig.,  821  F.3d  410,  434  (3rd  Cir.  2016) 
(quoting  Warfarin  Sodium  Antitrust  Litig. ,  391  F.3d  516,  533-34  (3rd  Cir.  2004).)  A  class  action 
is  superior  where  “’the  rights  of  groups  of  people  who  individually  would  be  without  effective 
strength  to  bring  their  opponents  into  court  at  all.’”  Datta  v.  Asset  Recovery  Solutions,  LLC,  2016 

65  Pertinent  matters  include:  (1)  the  class  members’  interests  in  individually  controlling  the  prosecution  or  defense  of 
separate  actions;  (2)  the  extent  and  nature  of  any  litigation  concerning  the  controversy  already  begun  by  or  against 
class  members;  (3)  the  desirability  or  undesirability  of  concentrating  the  litigating  the  claims  in  the  particular  forum; 
and  (4)  the  likely  difficulties  in  managing  a  class  action.  Fed.  R.  Civ.  P.  23(b)(3)(A)-(D). 
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U.S.  Dist.  LEXIS  36446,  *29  (N.D.  Cal.  March  18,  2016)  (quoting  Amchem  Prods,  v.  Windsor , 
521  U.S.  591,  617  (1997).)  Class  actions  are  particularly  appropriate  where,  as  here,  “it  is 
necessary  to  permit  the  plaintiffs  to  pool  claims  which  would  be  uneconomical  to  litigate 
individually.”  Phillips  Petroleum  Co.  v.  Shutts,  472  U.S.  797,  809  (1985). 

88.  A  class  action  is  superior  to  any  other  available  means  for  the  fair  and  efficient 
adjudication  of  this  controversy,  and  no  unusual  difficulties  are  likely  to  be  encountered  in  the 
management  of  this  matter  as  a  class  action.  The  damages,  harm,  or  other  financial  detriment 
suffered  individually  by  Plaintiffs  and  the  other  Class  Members  are  relatively  small,  if  any, 
compared  to  the  burden  and  expense  that  would  be  required  to  litigate  their  claims  on  an  individual 
basis  against  Defendants,  making  it  impracticable  for  Class  Members  to  individually  seek  redress 
for  Defendants’  wrongful  conduct.  Even  if  Class  Members  could  afford  individual  litigation,  the 
court  system  could  not.  Individualized  litigation  would  create  a  potential  for  inconsistent  or 
contradictory  judgments  and  increase  the  delay  and  expense  to  all  parties  and  the  court  system.  By 
contrast,  the  class  action  device  presents  far  fewer  management  difficulties  and  provides  the 
benefits  of  single  adjudication  economies  of  scale,  and  comprehensive  supervision  by  a  single 
court. 

89.  Further,  Defendants  have  acted  or  failed  to  act  on  grounds  generally  applicable  to 
the  Class,  and  accordingly,  final  injunctive  or  corresponding  declaratory  relief  regarding  the  Class 
Members  as  a  whole  is  appropriate  under  Rule  23(b)(2)  of  the  Federal  Rules  of  Civil  Procedure. 

90.  Likewise,  particular  issues  under  Rule  23(c)(4)  are  appropriate  for  certification 
because  such  claims  present  only  particular,  common  issues,  the  resolution  of  which  would 
advance  the  disposition  of  this  matter  and  the  parties’  interests  therein.  Such  particular  issues 
include,  but  are  not  limited  to: 
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a.  Whether  Class  Members’  Personal  Information  was  obtained  by  GSR,  SCL  Entities 
and  Cambridge  Defendants  and/or  their  agents; 

b.  Whether  (and  when)  Facebook  knew  about  the  improper  collection  and  theft  of 
Personal  Information; 

c.  Whether  Defendants’  conduct  violated  the  SCA,  18  U.S.C.  §§  2701,  etseq.; 

d.  Whether  Facebook’ s  representations  that  they  would  secure  and  not  disclose,  without 
consent,  the  Personal  Information  of  Plaintiffs  and  Class  Members  were  facts  that 
reasonable  persons  could  be  expected  to  rely  upon  when  deciding  whether  to  use 
Facebook’s  services; 

e.  Whether  Facebook  misrepresented  the  safety  of  its  many  systems  and  services, 
specifically  the  security  thereof,  and  their  ability  to  safely  store  Plaintiffs’  and  Class 
Members’  Personal  Information; 

f.  Whether  Facebook  failed  to  comply  with  its  own  policies  and  applicable  laws, 
regulations,  the  FTC  Consent  Judgment,  and  industry  standards  relating  to  data 
security; 

g.  Whether  Facebook  failed  to  meet  its  obligations  under  the  User  Terms  of  Service; 

h.  Whether  Defendants’  acts,  omissions,  misrepresentations,  and  practices  were  and  are 
likely  to  deceive  consumers; 

i.  Whether  Facebook  failed  to  adhere  to  its  posted  privacy  policy  concerning  the  care  it 
would  take  to  safeguard  and  protect  Class  Members’  Personal  Information;  and 

j.  Whether  Facebook  negligently  and  materially  failed  to  adhere  to  its  posted  privacy 
policy  with  respect  to  the  extent  of  its  disclosure  of  users’  Personal  Information. 
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CAUSES  OF  ACTION 

Claim  I:  Violation  of  the  Stored  Communications  Act, 

18  U.S.C.  §§  2701,  et  seq.  Against  GSR,  Kogan,  SCL  Entities  and  Cambridge 

91.  Plaintiffs  hereby  adopt  by  reference  each  and  every  preceding  paragraph  stated  in 
this  Complaint  as  if  fully  set  forth  herein. 

92.  The  Stored  Communications  Act  (“SCA”)  allows  a  private  right  of  action  against 
anyone  who  “(1)  intentionally  accesses  without  authorization  a  facility  through  which  an  electronic 
communication  service  is  provided;  or  (2)  intentionally  exceeds  an  authorization  to  access  that 
facility;  and  thereby  obtains,  alters,  or  prevents  authorized  access  to  a  wire  or  electronic 
communication  while  it  is  in  electronic  storage  in  such  system.”  See  18  U.S.C.  §  2701(a);  see  also 
18  U.S.C.  §  2707(a)  (cause  of  action). 

93.  The  Electronic  Communications  Privacy  Act,  18  U.S.C.  §§  2510,  et  seq.,  defines 
an  “electronic  communication”  as  “any  transfer  of  signs,  signals,  writing,  images,  sounds,  data,  or 
intelligence  of  any  nature  transmitted  in  whole  or  in  part  by  a  wire,  radio,  electromagnetic, 
photoelectronic  or  photooptical  system  that  affects  interstate  or  foreign  commerce  ....”18  U.S.C. 
§  2510(12).  The  SCA  incorporates  this  definition  of  “electronic  communication.” 

94.  To  create  the  information  transferred  to  Facebook  such  as  all  posts,  private 
messages,  and  similar  communication  (collectively  “Facebook  content”),  Facebook  users  transmit 
writing,  images,  or  other  data  via  the  Internet  from  their  computers  or  mobile  devices  to 
Facebook’s  servers.  This  Facebook  content,  therefore,  constitutes  electronic  communications  for 
purposes  of  the  SCA. 

95.  The  SCA  defines  “electronic  communication  service”  as  “any  service  which 
provides  to  users  thereof  the  ability  to  send  or  receive  wire  or  electronic  communications.”  18 
U.S.C.  §  2510(15).  Facebook  content  is  transmitted  via  an  electronic  communication  service 
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because  Facebook  provides  its  users  with  the  ability  to  send  or  receive  wire  or  electronic 
communications,  including  private  messages  and  wall  posts.  Facebook,  therefore,  is  an  electronic 
communication  service  provider  for  purposes  of  the  SCA. 

96.  The  SCA  distinguishes  between  two  types  of  electronic  storage.  The  first  is  defined 
as  “any  temporary,  intermediate  storage  of  a  wire  or  electronic  communication  incidental  to  the 
electronic  transmission  thereof.”  18  U.S.C.  §  2510(17)(A).  The  second  type  is  defined  as  “any 
storage  of  such  communication  by  an  electronic  communication  for  purposes  of  backup  protection 
of  such  communication.”  18  U.S.C.  §  2510(17)(B).  Because  Facebook  saves  and  archives 
Facebook  content  indefinitely,  Facebook  content  is  stored  in  electronic  storage  for  purposes  of  the 
SCA. 

97.  Facebook  allows  users  to  select  privacy  settings  for  their  Facebook  content.  Access 
can  be  limited  to  a  user’s  Facebook  friends,  to  particular  groups  or  individuals,  or  to  just  the 
particular  Facebook  user.  When  users  make  Facebook  content  inaccessible  to  the  general  public, 
the  information  is  considered  private  for  purposes  of  the  SCA. 

98.  Defendants  GSR,  Kogan,  SCL  Entities  and  Cambridge  have  violated  18  U.S.C.  § 
2701(a)  because  they  intentionally  accessed,  either  directly  or  indirectly  through  an  agent, 
Plaintiffs’  information  and/or  intentionally  exceeded  their  authorization  to  access  Plaintiffs’ 
information  and,  in  so  doing,  obtained  unauthorized  access  to  an  electronic  communication  while 
in  electronic  storage. 

99.  Defendants  GSR,  Kogan,  SCL  Entities  and  Cambridge  had  actual  knowledge  of, 
and  benefitted  from,  this  practice  including  the  gain  of  monetary  profits. 

100.  As  a  result  of  Defendants’  conduct  described  herein  and  its  violations  of  §  2701, 
Plaintiffs  and  the  Class  have  suffered  actual  injury  in  the  form  of  dissemination  of  private 
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information,  loss  of  sales  value  of  private  information,  costs  of  mitigation  for  the  disclosure,  loss 
of  the  benefit  of  the  bargain  as  a  Facebook  user  by  excess  disclosure  of  private  information 
necessary  to  use  the  Facebook  service,  and  emotional  distress. 

101.  Plaintiffs,  on  behalf  of  themselves  and  the  Class,  seek  an  order  enjoining 
Defendants’  conduct  and  are  entitled  to  the  greater  of  their  actual  damages  or  statutory  damages 
of  $1,000  per  violation,  as  well  as  disgorgement,  punitive  damages,  attorneys’  fees,  and  costs.  18 
U.S.C.  §  2707(c) 

Claim  II:  Violation  of  the  Stored  Communications  Act, 

18  U.S.C.  §§  2701,  et  seq.  Against  Facebook 

102.  Plaintiffs  hereby  adopt  by  reference  each  and  every  preceding  paragraph  stated  in 
this  Complaint  as  if  fully  set  forth  herein. 

103.  The  Stored  Communications  Act  (“SCA”)  allows  a  private  right  of  action  against 
“a  person  or  entity  providing  an  electronic  communication  service  to  the  public”  who  “knowingly 
divulge(s)  to  any  person  or  entity  the  contents  of  a  communication  while  in  electronic  storage  by 
that  service.”  See  18  U.S.C.  §  2702(a)(1);  see  also  18  U.S.C.  §  2707(a)  (cause  of  action). 

104.  The  Electronic  Communications  Privacy  Act,  18  U.S.C.  §§  2510,  et  seq.,  defines 
an  “electronic  communication”  as  “any  transfer  of  signs,  signals,  writing,  images,  sounds,  data,  or 
intelligence  of  any  nature  transmitted  in  whole  or  in  part  by  a  wire,  radio,  electromagnetic, 
photoelectronic  or  photooptical  system  that  affects  interstate  or  foreign  commerce  . . ..”  18  U.S.C. 
§  25 10(12).  The  SCA  incorporates  this  definition  of  “electronic  communication.” 

105.  To  create  the  information  transferred  to  Facebook  such  as  all  posts,  private 
messages,  and  similar  communication  (collectively  “Facebook  content”),  Facebook  users  transmit 
writing,  images,  or  other  data  via  the  Internet  from  their  computers  or  mobile  devices  to 
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Facebook’s  servers.  This  Facebook  content,  therefore,  constitutes  electronic  communications  for 
purposes  of  the  SCA. 

106.  The  SCA  defines  “electronic  communication  service”  as  “any  service  which 
provides  to  users  thereof  the  ability  to  send  or  receive  wire  or  electronic  communications.”  18 
U.S.C.  §  2510(15).  Facebook  content  is  transmitted  via  an  electronic  communication  service 
because  Facebook  provides  its  users  with  the  ability  to  send  or  receive  wire  or  electronic 
communications,  including  private  messages  and  wall  posts.  Facebook,  therefore,  is  an  electronic 
communication  service  provider  for  purposes  of  the  SCA. 

1 07.  The  SCA  distinguishes  between  two  types  of  electronic  storage.  The  first  is  defined 
as  “any  temporary,  intermediate  storage  of  a  wire  or  electronic  communication  incidental  to  the 
electronic  transmission  thereof.”  18  U.S.C.  §  2510(17)(A).  The  second  type  is  defined  as  “any 
storage  of  such  communication  by  an  electronic  communication  for  purposes  of  backup  protection 
of  such  communication.”  18  U.S.C.  §  2510(17)(B).  Because  Facebook  saves  and  archives 
Facebook  content  indefinitely,  Facebook  content  is  stored  in  electronic  storage  for  purposes  of  the 
SCA. 

1 08.  Facebook  allows  users  to  select  privacy  settings  for  their  Facebook  content.  Access 
can  be  limited  to  a  user’s  Facebook  friends,  to  particular  groups  or  individuals,  or  to  just  the 
particular  Facebook  user.  When  users  make  Facebook  content  inaccessible  to  the  general  public, 
the  information  is  considered  private  for  purposes  of  the  SCA. 

109.  Defendant  Facebook  is  a  “person  or  entity  providing  an  electronic  communication 
service  to  the  public”  as  set  forth  by  the  SCA,  meaning  that  Facebook’s  content  is  covered  by  the 
SCA.  Ehling  v.  Monmouth-Ocean  Hospital  Service,  961  F.  Supp.  2d  659,  666  (D.N.J.  2013). 
Defendant  Facebook  has  itself  conceded  and  recognized  that  the  SCA  was  enacted  by  Congress  to 
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address  access  to  stored  electronic  communications  such  as  those  on  Facebook’s  platform. 
Campbell  v.  Facebook Inc.,  77  F.  Supp.  3d  836,  840-41  (N.D.  Cal.  2014). 

110.  Facebook  knowingly  allowed  Defendants  GSR,  Kogan,  SCL  Entities  and 
Cambridge,  directly  or  indirectly,  through  the  creation  of  an  application  as  a  developer,  to 
improperly  access  the  Facebook  content  or  Personal  Information  of  71.6  million  registered 
Facebook  users  without  their  knowledge  or  consent. 

111.  Defendant  Facebook  has  violated  18  U.S.C.  §  2702(a)  because  it  knowingly 
divulged  to  GSR,  SCL  Entities  and  Cambridge,  either  directly  or  indirectly,  the  contents  of  a 
communication  while  in  Facebook’s  electronic  storage  through  the  creation  of  an  application  as  a 
developer. 

112.  Defendant  Facebook  had  actual  knowledge  of,  and  benefitted  from,  this  practice 
including  the  gain  of  monetary  profits. 

1 13.  As  a  result  of  Defendants’  conduct  described  herein  and  its  violations  of  §  2702, 
Plaintiffs  and  the  Class  have  suffered  actual  injury  in  the  form  of  dissemination  of  private 
information,  loss  of  sales  value  of  private  information,  costs  of  mitigation  for  the  disclosure,  loss 
of  the  benefit  of  the  bargain  as  a  Facebook  user  by  excess  disclosure  of  private  information 
necessary  to  use  the  Facebook  service,  and  emotional  distress. 

114.  Plaintiffs,  on  behalf  of  themselves  and  the  Class,  seek  an  order  enjoining 
Defendant’s  conduct  and  are  entitled  to  the  greater  of  their  actual  damages  or  statutory  damages 
of  $1,000  per  violation,  as  well  as  disgorgement,  punitive  damages,  attorneys’  fees,  and  costs.  18 
U.S.C.  §  2707(c) 
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Claim  III:  Negligence  And  Willful  Negligence  Against  Facebook 

115.  Plaintiffs  hereby  adopt  by  reference  each  and  every  preceding  paragraph  stated  in 
this  Complaint  as  if  fully  set  forth  herein. 

1 16.  Defendant  Facebook  had  a  duty  to  protect  the  privacy  and  personal  information  of 
its  users. 

117.  Defendant  Facebook  had  a  duty  to  comply  with  the  requirements  set  forth  in  the 
FTC  Consent  Order. 

1 1 8.  Defendant  Facebook  breached  those  duties  when  it  allowed  third  parties  access  to 
its  users’  Personal  Information,  when  it  failed  to  take  adequate  remedial  measures  to  protect  users’ 
Personal  Information,  and  when  it  failed  to  notify  its  users  of  the  data  breach.  Defendant 
Facebook’ s  negligence  constituted  a  willful  and  conscious  disregard  of  the  rights  of  Plaintiffs  and 
the  Class  Members  when  it,  with  knowledge  of  the  high  and  unacceptable  risk  of  the  means  of 
unauthorized  data  access  and  the  known  ability  to  eliminate  such  means,  declined  and/or  refused 
to  take  such  measures  and  utilize  such  known  means  to  adequately  protect  users’  Personal 
Information. 

119.  Defendant  Facebook’s  allowing  third  parties  to  access  its  users’  Personal 
Information,  failure  to  take  adequate  remedial  measures  to  protect  users’  Personal  Information, 
and  failure  to  notify  its  users  of  the  data  breach  caused  Plaintiffs’  and  Class  Members  harm  because 
users’  privacy  rights  were  violated  and  they  lacked  adequate  notice  to  protect  themselves  and  their 
privacy  interests. 

Claim  IV:  Fraud  Against  Facebook 

120.  Plaintiffs  hereby  adopt  by  reference  each  and  every  preceding  paragraph  stated  in 
this  Complaint  as  if  fully  set  forth  herein. 
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121.  F acebook,  as  part  of  the  Consert  Order,  made  public  assurances  to  the  Plaintiffs  and 
Class  Members  that  Facebook  would  take  steps  to  prevent  disclosure  of  nonpublic  user  information 
to  any  third  party  without,  among  other  things,  first  obtaining  the  users’  affirmative  consent.  At 
the  time  of  this  public  announcement,  Facebook  knew  that  third  parties  could  access  the  personal 
information  of  users  through  applications  that  users  themselves  had  not  given  access  to,  e.g.,  if  the 
users’  Friends  had  granted  a  third-party  application  access.  At  the  time  it  made  the  public 
commitments  in  the  Consent  Order,  Facebook  did  not  intend  to  stop  that  means  of  access  as 
evidenced  by  its  failure  to  make  any  such  changes  to  its  platform.  As  a  result,  Facebook’ s 
assurances  in  the  Consent  Order  were  false  and  misleading. 

122.  This  misrepresentation  was  material.  The  FTC  deemed  disclosure  of  nonpublic 
information  of  Facebook  users  without  consent  to  be  significant  enough  to  sue  Facebook  for  that 
action.  Further,  upon  information  and  belief  Facebook  knew  that  this  access  to  personal 
information  of  an  unknowing  user  would  cause  that  user  substantial  injury. 

123.  Plaintiffs  and  the  Class  Members  were  entitled  to,  and  in  fact  did,  rely  on 
Facebook’ s  misrepresentations.  This  reliance  was  detrimental  to  Plaintiffs  and  the  Class  Members. 
For  example,  Facebook’s  misrepresentations  gave  Plaintiffs  and  the  Class  Members  a  false  sense 
of  security  regarding  access  to  their  respective  nonpublic  information  that  was  in  Facebook’s 
possession.  This  reliance  enabled  GSR’s,  SCL  Entities’  and  Cambridge’s  acquisition  of  Plaintiffs’ 
and  the  Class  Members’  nonpublic  information,  which  caused  Plaintiffs  and  the  Class  Members 
to  suffer  damages  in  an  amount  to  be  proved  at  trial. 

1 24.  Plaintiffs  and  the  Class  Members  are  entitled  to  recover  punitive  damages  as  a  result 
of  Facebook’s  fraudulent  conduct. 
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Claim  V:  Fraud  Against  GSR,  Kogan,  SCL  Entities  and  Cambridge 

125.  Plaintiffs  hereby  adopt  by  reference  each  and  every  preceding  paragraph  stated  in 
this  Complaint  as  if  fully  set  forth  herein. 

1 26.  GSR,  SCL  Entities  and  Cambridge’s  agent,  misrepresented  both  the  purpose  of  and 
authorization  for  GSR’s,  Kogan’s,  SCL  Entities’  and  Cambridge’s  data  pull  from  Facebook  of 
nonpublic  user  information,  including  that  of  Plaintiffs  and  the  Class  Members. 

127.  Facebook,  relying  on  these  misrepresentations,  permitted  GSR,  Kogan,  SCL 
Entities,  and  Cambridge  to  complete  the  illegal  data  pull.  Although  GSR,  Kogan,  SCL  Entities, 
and  the  Cambridge  entities  directed  their  misrepresentations  at  Facebook,  Plaintiffs  and  the  Class 
Members  -  specifically  their  nonpublic  information  -  were  the  actual  targets  of  GSR’s,  Kogan’s, 
SCL  Entities’  and  Cambridge’s  fraudulent  plan.  GSR’s,  Kogan’s,  SCL  Entities’,  and  Cambridge’s 
misrepresentations  were  material;  the  misrepresentations  enabled  GSR,  Kogan,  SCL  Entities  and 
Cambridge  to  access  nonpublic  information  of  71.6  million  Facebook  users,  including  Plaintiffs 
and  the  Class  Members,  for  which  GSR,  Kogan,  SCL  Entities,  and  Cambridge  lacked  authorization 
and/or  consent. 

128.  GSR’s,  Kogan’s,  SCL  Entities’,  and  Cambridge’s  fraudulent  acquisition  of 
Plaintiffs’  and  the  Class  Members’  nonpublic  information  caused  Plaintiffs  and  the  Class  Members 
to  suffer  damages  in  an  amount  to  be  proven  at  trial. 

129.  Plaintiffs  and  the  Class  Members  are  entitled  to  recover  punitive  damages  as  a  result 
of  GSR’s,  Kogan’s,  SCL  Entities’,  and  Cambridge’s  fraudulent  conduct. 
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JURY  DEMAND 

Plaintiffs  assert  their  rights  under  the  Seventh  Amendment  to  the  U.S.  Constitution  and 
demands,  in  accordance  with  Federal  Rules  of  Civil  Procedure  38,  a  trial  by  jury  on  all  issues. 

PRAYER  FOR  RELIEF 

WHEREFORE,  Plaintiffs,  individually  and  on  behalf  of  the  putative  Class  Members, 
respectfully  prays  that  the  Court  enter  an  order:  (a)  certifying  the  United  States  Class  and 
appointing  Plaintiffs  as  Class  Representatives;  (b)  finding  that  Facebook’s  conduct  violated  the 
Store  Communications  Act;  (c)  finding  that  GSR’s,  Kogan’s,  SCL  Entities’,  and  Cambridge’s 
conduct  violated  the  Store  Communications  Act;  (d)  finding  that  Facebook’s  conduct  breach  its 
agreements  with  Plaintiffs  and  the  Class  Members;  (e)  finding  that  Facebook’s  conduct  was 
negligent;  (f)  finding  that  Facebook’s  negligence  constituted  a  willful  and  conscious  disregard  of 
the  rights  of  Plaintiffs  and  the  Class  Members  under  Cal.  Civ.  Code  §  3294  and  common  law;  (g) 
finding  that  Facebook  committed  fraud  on  Plaintiffs  and  the  Class  Members;  (h)  finding  that  GSR, 
Kogan,  SCL  Entities,  and  Cambridge  committed  fraud  on  Facebook  that  damaged  Plaintiffs  and 
the  Class  Members;  (i)  enjoining  all  Defendants  from  engaging  in  further  negligent  and  unlawful 
business  practices;  (j)  awarding  Plaintiffs  and  the  Class  Members  nominal,  actual,  compensatory, 
and  consequential  damages;  (1)  awarding  Plaintiffs  and  the  Class  Members  statutory  damages  and 
penalties,  as  allowed  by  law;  (m)  awarding  Plaintiffs  and  Class  Members  restitution  and 
disgorgement;  (n)  awarding  Plaintiffs  and  the  Class  Members  punitive  damages  against  Facebook, 
GSR,  Kogan,  SCL  Entities,  and  Cambridge,  separately;  (o)  awarding  Plaintiff  and  the  Class 
Members  pre-judgment  and  post-judgment  interest;  (p)  awarding  Plaintiff  and  the  Class  Members 
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reasonable  attorneys’  fees,  costs,  and  expenses;  and  (q)  granting  such  other  relief  as  the  Court 
deems  just  and  proper. 

Dated:  April  10,  201 8  CROSS  &  SIMON,  LLC 


/s/  Christopher  P.  Simon  _ 

Christopher  P.  Simon  (No.  3697) 

David  G.  Holmes  (No.  4718) 

1105  North  Market  Street,  Suite  901 
Telephone:  (302)  777-4200 
Facsimile:  (302)  777-4224 
csimon@crosslaw.com 
dholmes@crosslaw.com 

-  and  - 

RUYAK  CHERIAN  LLP 

Robert  F.  Ruyak  (pro  hac  vice  to  be  submitted) 

Korula  T.  Cherian  (pro  hac  vice  to  be  submitted) 

Richard  Ripley  (pro  hac  vice  to  be  submitted) 

Rebecca  Anzidei  (pro  hac  vice  to  be  submitted) 

1700  K  Street  NW,  Suite  810 

Washington,  DC  20006 

Telephone:  (202)  838-1560 

robertr@,ruyakcherian.com 

sunnyc@ruyakcherian.com 

rickr@ruvakcherian.com 

rebeccaa@,ruy  akcherian .  com 


-  and  - 


FIELDS  PLLC 

Richard  W.  Fields  (pro  hac  vice  to  be  submitted) 

1700  K  Street,  NW,  Suite  810 

Washington,  DC  20006 

(800)  878-1432 

Fields@fieldslawpllc.com 

-  and  - 
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MCCUE  &  PARTNERS,  LLP 

Matthew  Jury  (pro  hac  vice  to  be  submitted) 

Fourth  Floor 

158  Buckingham  Palace  Road 
London  SWIW  9TR 
United  Kingdom 
matthew.iurv@mccue-law.com 


Counsel  for  Plaintiffs  and  Proposed  Class 
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GS  Data  end  Technology  Subscription  Agreement 


DATED:  4  JUNE  2014 
PARTIES 

(1)  GLOBAL  SCIENCE  RESEARCH  LTD  (Company  Number:  060785)  whose  trading 
office  is  at  MAGDALENE  COLLEGE,  CAMBRIDGE  CB3  OAG,  United  Kingdom 
(“GS’’  or  “Licensor”) 

(2)  SCL  ELECTIONS  LIMITED  (Company  Number;  08256225)  whose  trading  office  is  at 
108  New  Bond  Street,  London  W1S  1EF,  United  Kingdom  (“SCL"  or  “Licensee"). 

Preliminary 

This  GS  Profiled  Data  and  GS  Technology  Subscription  Agreement  (“Agreement*')  is  between 
Licensor  (GS)  and  the  Licensee  (SCL)  who  wishes  to  use  the  licensed  GS  Technology  and  GS 
Profiled  Data  for  use  as  an  end  user.  This  Agreement  covers  GS  Technology,  GS  Profiled  Data 
and  any  related  Software  and  Documentation. 


Term  and  Access 


1.1 

1.2 

1.3 

1.4 

1.5 


2.  Fees 
2.1 

2.2 

2.3 

2.4 

2.5 


GS  grants  SCL  a  subscription  Licence  to  use  GS  Technology  and  access  GS 
Profiled  Data  in  the  Territory  subject  to  the  terms,  rights,  restrictions  and 
limitations  contained  in  this  Agreement. 

The  subscription  Licence  will  commence  on  the  Commencement  Date  and 
continue  until  the  earlier  of  (a)  November  31, 2014  {the  Term)  or  (b)  such  time  as 
one  party  gives  notice  to  the  other  in  accordance  with  clause  1 0. 

A  Project  and  Specification  Schedule  (Schedule  2)  has  been  prepared  by  GS  and 
SCL  that  identifies  any  specific  outcomes  from  the  GS  Technology  or  GS  Profiled 
Data  (the  Deliverables)  and  the  Fees  to  be  paid  by  SCL  to  GS. 

in  addition  to  the  GS  Technology  and  GS  Profiled  Data,  GS  may  carry  out  further 
duties  or  Services  as  agreed  between  the  parties  in  writing  from  time  to  time. 

This  Agreement  will  prevail  over  any  inconsistent  terms  or  conditions  contained,  or 
referred  to  in  any  other  communications,  pre-contractual  representations, 
mistakes,  correspondence,  terms  or  material  supplied  by  either  party,  or  by  third 
parties,  or  implied  by  law,  trade  custom,  practice  or  course  of  dealing. 


SCL  will  pay  to  GS  the  Fees  in  accordance  with  the  relevant  Project  and 
Specification  Schedule. 

The  Fees  will  be  payable  within  seven  (07)  Working  Days  of  the  date  of  invoice,  to 
be  invoiced  by  GS  to  SCL  on  a  mutually  agreed  upon  rolling  basis  throughout  the 
course  of  the  Term. 

VAT  or  any  other  sales  taxes  (if  any)  will  be  excluded  from  the  Fees. 

All  amounts  due  under  this  agreement  will  be  paid  by  SCL  to  GS  in  full  without 
any  set-off,  counterclaim,  deduction  or  withholding  (other  than  any  deduction  or 
withholding  of  tax  as  required  by  law). 

GS  shall  make  available  to  SCL  receipts  of  expenditures  for  review,  inspection 
and  final  approval  by  SCL  where  such  approval  shall  remain  in  the  judgement  of 
SCL.  GS  shall  also  submit  weekly  invoices  in  advance  of  spending  monies  on 
online  harvesting  exercises.  For  the  avoidance  of  doubt,  invoices  shall  contain 
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the  receipts  from  online  panels,  online  surveying  utilities,  online  display  networks 
or  online  recruitment  sites,  whichever  the  case  may  be,  and  the  monetary  amount 
listed  on  that  receipt  must  match  the  monetary  amount  being  requested  by  the  GS 
invoice. 

2.6  Unless  otherwise  approved  by  SCL,  GS  warrants  that  monies  transferred  to  it 
shall  only  be  used  for  the  procurement  or  harvesting  of  samples  from  online 
panels,  online  surveying  utilities,  online  display  networks  or  online  recruitment 
sites,  whichever  the  case  may  be,  to  further  develop,  add  to,  refine  and 
supplement  GS  psychometric  scoring  algorithms,  databases  and  scores,  and  that 
no  monies  from  SCL  shall  be  spent  by  GS  on  salaries,  consultant  fees,  personnel, 
office  space,  travel,  promotions  and  advertising, 

2.7  Where  travel  is  required  and  necessary  for  the  completion  of  the  Project,  GS  must 
first  seek  advance  written  approval  of  such  travel  expenses  from  SCL. 

2.8  Where  there  are  reasonable  costs  that  are  not  borne  from  data  collection  but  are 
advantageous  to  the  delivery  of  Project,  such  as  IT  security,  GS  must  first  seek 
advance  written  approval  of  such  non-data  expenses  from  SCL. 

3,  Standards 

3.1  GS  will  provide  SCL  use  of  the  GS  Technology  and  access  to  GS  Profiled  Data 
using  a  “Software-as-a-Service”  model. 

3.2  GS  will  reasonably  endeavour  to  allocate  sufficient  resources,  including  qualified 
personnel,  to  carry  out,  manage  and  support  the  reliable  functioning  of  the  GS 
Technology,  GS.  online  social  media  databases  and  GS  Profiled  Data. 

3.3  In  the  event  that  GS  is  unabte  to  provide  sufficient  resources  or  personnel  after 
reasonable  efforts  given  the  constraints  set  out  in  clause  2.6,  SCL  will  support  GS 
in  procuring  resources  or  personnel  for  GS  to  use  as  its  own  agents  to  temporarily 
carry  out,  manage  and  support  the  GS  Technology,  GS  online  social  media 
databases  and  GS  Profiled  Data.  GS  shall  not  refuse  such  assistance  unless  GS 
determines  that  such  assistance  risks  exposing  or  harming  GS's  Intellectual 
Property  Rights. 

3.4  For  the  avoidance  of  doubt,  GS  is  entitled  to  use,  at  its  discretion,  third  party 
contractors,  subcontractors,  vendors,  affiliates  and  third  parties  to  assist  it  with 
delivering  this  Project  and/or  with  carrying  out,  managing  and  supporting  the  GS 
Technology,  GS’s  online  social  media  database  and  GS  Profiled  Data, 

4.  Licensee  obligations 

SCL  will: 

4.1  co-operate  with  GS  in  all  matters  relating  to  the  Project; 

4.2  provide  such  information  relating  to  SCL  as  GS  may  request  and  SCL  considers 
reasonably  necessary,  in  order  to  deliver  the  Project  and  carry  out,  manage  and 
support  the  reliable  functioning  of  the  GS  Technology  and  GS  Profiled  Data,  in  a 
timely  manner,  and  ensure  that  it  is  accurate  in  all  materia!  respects;  and 

4.3  not  attempt  to  appropriate,  assert  claim  to,  restrict  or  encumber  the  rights  held  in, 
interfere  with,  deconstruct,  discover,  decompile,  disassemble,  reconstruct  or 
otherwise  reverse-engineer  the  GS  Technology,  GS  Profiled  Data  or  GS's 
algorithms,  current  or  future  datasets  or  databases  harvested  using  the  GS 
Technology,  methods,  formulae,  compositions,  designs,  source  code,  underlying 
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ideas,  file  formats,  programming  Interfaces,  inventions  and  conceptions  of 
inventions  whether  patentable  or  un-patentable. 

5.  Change  Control 

5.1  An  authorised  representative  of  SCL  and  an  authorised  representative  of  GS  will 
meet  at  least  once  every  week,  either  in  person  or  via  a  virtual  platform,  to  discuss 
matters  relating  to  the  Project.  If  either  party  wishes  to  change  the  scope  of  the 
Licence  or  execution  of  the  Project,  it  will  submit  details  of  the  requested  change 
to  the  other  in  writing. 

5.2  If  either  party  requests  a  change  to  the  scope  of  the  Licence  or  execution  of  the 
Project,  GS  will,  within  a  reasonable  time  {and  in  any  event  not  more  than  five 
working  days  after  receipt  of  SCL’s  request),  provide  a  written  estimate  to  SCL  of: 

5  2,1  the  likely  time  required  to  implement  the  change; 

5.2.2  any  necessary  variations  to  the  Fees  arising  from  the  change;  and 

5.2.3  any  other  impact  of  the  change  on  this  agreement. 

5.3  Unless  both  parties  agree  in  writing  to  a  proposed  change,  there  will  be  no  change 
to  this  Agreement. 

5.4  If  both  parties  agree  in  writing  to  a  proposed  change,  the  change  will  be  made, 
only  after  agreement  of  the  necessary  variations  to  the  Fees,  the  Project,  the 
Licence  and  any  other  relevant  terms  of  this  Agreement  to  take  account  of  the 
change  that  has  been  reached.  The  agreement  must  be  varied  in  accordance 
with  clause  1 3. 

$,  GS  Licence 

6.1  GS  grants  to  SCL  a  non-transferrable,  non-sublicenseabie,  non-assignable,  non¬ 
exclusive  and  limited  subscription  licence  (“Licence")  to  use  GS's  online  data 
harvesting  and  psychological  profiling  technology  (“GS  Technology”)  and  to 
access  psychological  scores  created  by  GS*§  underlying  harvested  datasets  and 
algorithms  (“GS  Profiled  Data")  to  further  enhance  or  augment  its  political 
modelling  of  the  population  in  eleven  states  within  the  Territory  unless  a  future 
superseding  agreement  can  be  reached. 

6.2  Notwithstanding  anything  to  the  contrary  contained  herein,  except  for  the  limited 
license  rights  expressly  provided  herein,  GS  has  and  will  retain  all  rights,  title  and 
interest  (including,  without  limitation,  all  patent,  copyright,  trademark,  rights  in 
underlying  databases,  trade  secret,  know-how  and  other  Intellectual  Property 
Rights)  in  and  to  the  GS  Technology,  GS  Profiled  Data,  and  all  copies, 
modifications,  constituent  data  components  and  derivative  works  thereof.  SCL 
acknowledges  that  it  is  obtaining  only  a  limited  license  right  to  use  the  GS 
Technology  and  GS  Profiled  Data  and  that  irrespective  of  any  use  of  the  words 
“purchase”,  “sale”  or  like  terms  hereunder  no  ownership  rights  are  being  conveyed 
to  SCL  under  this  Agreement  or  otherwise, 

6.3  SCL  shall  not  release,  risk,  deposit  or  otherwise  make  available  any  of  GS’s 
proprietary,  sensitive  or  confidential  information  or  data  to  the  public  or  to  SCL's 
clients,  partners  or  affiliates,  particularly  if  that  information  or  data  could  be  used 
to  deconstruct,  discover,  decompile,  disassemble,  reconstruct  or  otherwise 
reverse-engineer  the  GS  Technology,  GS  Profiled  Data  or  GS’s  algorithms, 
current  or  future  datasets  or  databases,  methods,  formulae,  compositions, 
designs,  source  code,  underlying  ideas,  file  formats,  programming  interfaces, 
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inventions  and  conceptions  of  inventions  whether  patentable  or  un-patentable, 
SCL  also  shall  not  archive  any  of  GS’s  Intellectual  Property  beyond  the  Term- 

6.4  SCL  shall  keep  all  of  GS's  proprietary,  sensitive  or  confidential  information  or  data 
strictly  confidential  by  using  a  reasonable  degree  of  care,  but  not  less  than  the 
degree  of  care  used  by  it  in  safeguarding  its  own  confidential  information. 

6.5  SCL  acknowledges  that  any  and  all  Intellectual  Property  Rights  held  or  owned  or 
otherwise  controlled,  utilised,  developed,  acquired,  created  or  licensed  by  GS  will 
continue  to  vest  with  GS.  Nothing  in  this  Agreement  shall  inhibit,  limit  or  restrict 
GS’s  ability  to  exploit,  assert,  transfer  or  enforce  any  Intellectual  Property  Rights 
anywhere  in  the  world. 

6.6  Neither  party  will  be  entitled  to  use  the  other  party's  marks  or  logos  (including  in 
connection  with  any  promotional  or  marketing  material,  or  exercise  any 
promotional  or  marketing  rights)  without,  on  each  and  every  occasion,  the  other 
party's  prior  written  approval. 

6.7  Upon  reasonable  notice  from  GS,  and  in  order  to  confirm  or  investigate 
compliance  with  the  provisions  of  this  Agreement,  SCL  shall  provide  access  to, 
and  the  right  to  inspect,  all  records  relating  to  the  GS  Technology,  GS’s  social 
media  database  and  GS  Profiled  Data,  and  access  logs  pertaining  to  any 
processing  thereof.  Unless  otherwise  agreed,  any  such  inspection  shall  occur  only 
at  the  business  offices  of  SCL,  during  normal  business  hours,  and  shail  be 
conducted  by  a  mutually  acceptable  third-party  inspector.  The  costs  of  any  such 
inspection  shall  be  paid  by  GS  upon  requesting  such  inspection  unless  a  data 
default  within  the  procedures  and  processes  of  SCL  is  discovered,  in  which  case 
SCL  wiil  be  obliged  to  reimburse  the  reasonable  costs  of  GS  and  any  relevant 
third  parties, 

7.  Liability 

7.1  Nothing  in  this  agreement  will  operate  to  exclude  or  limit  either  party's  liability  for 
death  or  personal  injury  caused  by  its  negligence,  for  fraud  or  for  any  other  liability 
which  cannot  be  excluded  or  limited  under  applicable  law, 

7.2  GS  will  not  in  any  circumstances  have  any  liability  for  any  loss  or  damage  which 
may  be  suffered  by  SCL,  whether  suffered  directly  or  indirectly,  whether 
immediate  or  consequential  and  whether  arising  in  contract,  tort  (including 
negligence)  or  otherwise,  which  falls  within  any  of  the  following  categories: 

7.2.1  special  or  indirect  or  consequential  damage  even  it  GS  was  aware  of 
the  circumstances  in  which  such  damage  could  arise;  or 

7.2.2  loss  of  profits  (whether  considered  a  direct  or  indirect  loss). 

7.3  GS’s  aggregate  liability  in  respect  of  claims  arising  out  of  or  in  connection  with  this 
agreement  or  any  collateral  contract,  whether  in  contract  or  tort  or  otherwise,  will 
not  exceed  the  Contract  Fee  paid  by  SCL  to  GS  under  this  Agreement. 

7.4  All  conditions,  warranties  or  other  terms  which  might  have  effect  between  the 
parties  or  be  implied  or  incorporated  into  this  agreement  or  any  collateral  contract, 
whether  by  statute,  common  law  or  otherwise,  are,  to  the  extent  permitted  by  law, 
excluded. 

8.  Confidentiality 

8.1  Either  party  may  disclose  (Disclosing  Party)  confidential  information  to  the  other 
party  (Receiving  Party)  in  relation  to  other  party’s  business,  business  practice, 
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8.2 

8.3 


8.4 


8.5 


8.6 


8.7 


8.8 


8.9 


8.10 


employees  or  other  confidential  information  relating  to  the  other  party's  business 
affairs  (Confidential  Information). 

For  the  avoidance  of  doubt,  Confidential  Information  shall  include,  but  not  be 
limited  to,  Documentation  or  any  information  provided  by  GS  to  SCI  pertaining  to 
GS  Technology  and  GS  Profiled  Data. 

The  Receiving  Party  will; 

8.3.1  not  use  such  Confidential  Information  other  than  for  the  purpose  of 
performing  its  obligations  under  this  agreement;  and 

8.3.2  not  disclose  such  Confidential  information  to  a  third  party  except  with 
the  prior  written  consent  of  the  Disclosing  Party  or  in  accordance  with 
clauses  8.4  and  8.5. 

The  Receiving  Party  may  disclose  Confidential  Information  to  any  of  its  directors, 
other  officers,  employees,  agents,  subcontractors  and  advisers  (a  Recipient)  to 
the  extent  that  disclosure  is  reasonably  necessary  for  the  purposes  of  this 
Agreement. 

The  Receiving  Party  will  ensure  that  each  Recipient  is  made  aware  of  and 
complies  with  the  Receiving  Party’s  obligations  of  confidentiality  under  this 
agreement  as  if  the  Recipient  were  a  party  to  this  agreement. 

The  Receiving  Party  must  not  make  any  copies  of  Confidential  Information  without 
the  express  consent  of  the  Disclosing  Party  and  must  maintain  and  protect  the 
Confidential  Information  with  the  same  degree  of  care  as  it  uses  to  keep 
confidential  its  own  proprietary  information,  but  in  any  event  with  not  less  than  a 
reasonable  degree  of  care. 

The  provisions  in  this  clause  8  do  not  apply  to  Confidential  Information  which: 

8.7.1  at  the  date  of  this  agreement  or  at  any  time  after  that  date,  becomes 
publicly  known,  other  than  by  the  Receiving  Party’s  or  a  Recipient’s 
breach  of  this  agreement. 

The  Receiving  Party  will  at  the  Disclosing  Party's  request  and  also  upon  any 
termination  of  this  agreement: 

8.8.1  return  to  the  Disclosing  Party  all  documents  and  other  materials  that 
contain  any  of  the  Confidential  Information,  including  all  copies  made; 
and 

8.8.2  permanently  delete  all  electronic  copies  of  Confidential  Information  from 
the  Receiving  Party’s  computer  systems  except  pursuant  to  legal, 
regulatory  or  professional  standards  requirements. 

Following  termination  of  this  agreement: 

8.9.1  the  Receiving  Party  will  make  no  further  use  of  the  Confidential 
Information;  and 

8.9.2  the  Receiving  Party’s  obligations  under  this  agreement  will  otherwise 
continue  in  force  in  respect  of  Confidential  Information,  disclosed 
without  limit  in  time. 

Any  disclosure  of  Confidential  Information  pursuant  to  this  agreement  will  not 
confer  on  the  Receiving  Party  any  intellectual  Property  Rights  in  relation  to  the 
Confidential  Information. 
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8.1 1  To  the  extent  that  the  Receiving  Party  may  be  required  to  disclose  Confidential 
Information  by  order  of  a  court  or  other  public  body  that  has  jurisdiction  over  the 
Receiving  Party,  it  may  do  so.  Before  making  such  a  disclosure  the  Receiving 
Party  will,  if  the  circumstances  permit,  inform  the  Disclosing  Party  of  the  proposed 
disclosure  as  soon  as  possible  (and  if  possible  before  the  court  or  other  public 
body  orders  the  disclosure  of  the  Confidential  Information). 

8.12  Neither  party  may  make  any  public  announcement  or  disclosure  regarding  the 
existence  or  subject  matter  of  this  Agreement,  unless  it  first  obtains  the  other 
party's  written  consent. 

8.1 3  For  the  avoidance  of  doubt,  the  Receiving  Party's  duty  of  confidence  shall  apply  to 
any  related  prior  communication  or  provision  of  Confidential  Information  by  the 
Disclosing  Party  to  the  Receiving  Party  that  occurred  prior  to  the  Commencement 
Date  of  this  Agreement, 

9.  Data  protection 

9.1  The  parties  warrant  and  undertake  to  each  other  that,  in  relation  to  this 
agreement  they  have  complied  with  and  will  continue  to  comply  with  the 
provisions  of  all  relevant  personal  information  legislation,  regulations  and/or 
directives  in  all  relevant  territories,  including,  for  the  avoidance  of  doubt,  the  Data 
Protection  Act  1998  and  any  safe  harbour  principles  agreed  between  the  United 
States  Department  of  Commerce  and  the  European  Commission.  Each  of  the 
parties  warrants  and  undertakes  that  it  will  not  knowingly  do  anything  or  permit 
anything  to  be  done  which  might  lead  to  a  breach  of  any  such  legislation, 
regulations  and/or  directives  by  the  other  party. 

9.2  GS  warrants  to  SCL  that  the  Terms  and  Conditions  of  the  GS  Technology  and  any 
other  related  data  harvesting  exercise  it  conducts  shall  seek  out  informed  consent 
of  the  seed  user  engaging  with  the  GS  Technology  and  that  GS  shall  materially 
and  substantially  conform  its  operations,  procedures,  databases  and  technologies 
to  the  eight  Data  Protection  Principles  as  outlined  In  Schedule  1  of  the  Data 
Protection  Act  1998. 

9.3  Both  parties  to  this  Agreement  assert  and  recognise  that  GS  is  the  Data  Controller 
per  Section  1(1)  of  the  Data  Protection  Act  1998  for  any  and  all  data  harvested 
using  the  GS  Technology  or  any  GS  online  social  media  database  and  therefore 
GS  shall  be  burdened  with  ensuring  compliance  with  the  Data  Protection  Act  1998 
and  the  Information  Commissioner's  Office. 

9.4  GS  shall  ensure  it  is  duly  registered  with  the  Information  Commissioner's  Office 
and  that  it  remains  in  good  standing  with  all  relevant  administrative  and  regulatory 
bodies. 

9.5  Upon  reasonable  notice  from  SCL.  and  in  order  to  confirm  or  investigate 
compliance  with  the  Data  Protection  Ad  1998  and  any  safe  harbour  principles 
agreed  between  the  United  States  Department  of  Commerce  and  the  European 
Commission,  GS  shall  provide  access  to,  and  the  right  to  inspect,  all  SCL  voter  file 
records  (SCL  Data)  transferred  to  GS  for  matching  to  GS  online  data  or  to  be 
scored  by  the  GS  Technology,  and  access  logs  pertaining  to  any  processing 
thereof.  Unless  otherwise  agreed,  any  such  inspection  shall  occur  only  at  the 
business  offices  of  GS,  during  normal  business  hours,  and  shall  be  conducted  by 
a  mutually  acceptable  third-party  inspector.  The  costs  of  any  such  inspection  shall 
be  paid  by  SCL  upon  requesting  such  inspection  unless  a  gross  statutory 
compliance  default  within  the  procedures  and  processes  of  GS  is  discovered,  in 
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which  case  GS  will  be  obliged  to  reimburse  the  reasonable  costs  of  SCL  and  any 
relevant  third  parties. 


10.  Termination 

10.1  Either  party  may  terminate  this  agreement  with  immediate  effect  at  any  time  by 
notice  in  writing  to  the  other  if; 

10.1.1  the  other  is  in  material  or  persistent  breach  of  any  provision  of  this 
Agreement,  and  the  breach,  if  capable  of  remedy,  is  not  remedied 
within  20  Working  Days  of  receipt  by  the  defaulting  party  of  notice 
requiring  the  breach  to  be  remedied;  or 

1 0.1 .2  the  other  party  suffers  an  Insolvency  Event. 

10.2  SCL  may  terminate  this  agreement  after  the  Trial  Sample  but  before  the  full 
Project  commences  if: 

10.2.1  the  SCL  voter  file  records  transferred  to  GS,  matched  to  GS  online 
harvested  data  and  scored  by  GS  Technology  do  not  meet  minimum 
quality  and  coverage  standards  set  forth  in  the  Agreement  as  outlined  in 
clause  10.3;  and 

10.2.2  reasonable  written  notice  is  delivered  to  GS. 

1 0.3  SCL  warrants  that  it  will  be  satisfied  that  GS  has  delivered  sufficient  quality  and 
coverage  if  the  Trial  Sample  delivered  to  SCL: 

10.3.1  contains  a  minimum  of  10,000  uniquely  matched  records  in  one  or  more 
of  the  States  as  defined  in  Schedule  2  of  this.  Agreement; 

1 0.3.2  where  no  record  contains  fewer  than  70%  of  the  number  of  scores  as 
agreed  to  in  Schedule  2  of  this  Agreement;  and 

10.3.3  where  a  matched  record  is  defined  as  an  entry  that  can  only  be 
matched  to  a  unique  single  record  in  the  SCL  dataset  and  where  unique 
is  defined  as  a  combination  of  the  record’s  forename,  surname,  gender 
and,  if  available,  birthday  and/or  location. 

1 0.4  Upon  the  completion  of  the  Project,  GS  shall  delete  any  data  transferred  by  SCL 
to  its  servers,  or  in  the  event  where  SCL  data  has  been  transferred  by  GS  onto 
third  party  cloud  computing  services,  GS  shall  order  that  cloud  server  to  delete  the 
data.  However,  SCL  data  may  be  used  for  academic  research  where  no  financial 
gain  is  made,  so  long  as  permission  is  granted  by  SCL  to  GS  at  the  end  of  the 
Project  where  permission  will  not  be  unreasonably  withheld.  GS  warrants  to  SCL 
that  GS  shall  not  commoditise  any  data  transferred  to  GS  by  SCL  unless  SCL 
grants  GS  written  permission  to  do  so  where  permission  shall  be  left  at  the  sole 
and  exclusive  discretion  of  SCL. 

10.5  In  the  event  that  GS  is  unable  to  provide  SCL  the  minimum  quality  standards  as 
stipulated  in  this  Agreement,  or  where  GS  fails  to  deliver  a  minimum  of  two  million 
(2,000,000)  matches  in  the  eleven  States  within  the  timeiine  outlined  in  Schedule 
2  of  this  Agreement,  then  SCL  shall  not  transfer  to  GS  any  of  its  data, 

10.6  In  the  event  that  GS  provides  SCL  with  two  million  one  hundred  thousand 
matched  records  (=2,100,000)  in  the  eleven  States  that  also  meet  the  minimum 
quality  standards  at  an  averaged  cost  of  each  matched  record  is  at  or  below  Fifty 
US  Cents  (USD  $0.50),  then  SCL  will  additionally  transfer  to  GS  a  dataset  of  circa 
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one  million  (~  1,000,000)  citizens  of  Trinidad  and  Tobago  for  use  in  academic 
research. 

1 0.7  For  the  avoidance  of  doubt,  GS  also  warrants  to  SCL  that  GS  shall  further  respect 
the  terms  of  the  “Master  License  and  Services  Agreement"  between  SCL  and 
InfoGroup  signed  in  March  2014  and  not  use  the  datasets  for  any  financial  gain. 

GS  will  also  seek  out  written  advance  permission  from  Cambridge  Analytica  LLC, 
a  Delaware  limited  liability  company,  where  that  data  is  to  be  published. 

10.8  SCL  Shall  retain  ownership  of  its  voter  file  datasets  and  nothing  in  this  Agreement, 
including  where  SCL  delivers  to  GS  samples  of  voter  data  for  matching  to  GS 
scores,  shall  be  construed  as  a  transfer  of  ownership  from  SCL  to  GS,  For  the 
avoidance  of  doubt,  any  SCL  data  used  by  GS  to  match  GS!s  harvested  online 
data  and  scores  to  the  SCL  voter  roll  or  to  SCL  consumer  data  must  be  separated 
from  the  GS  database  and  deleted  after  the  matching  exercise  is  completed 
unless  permission  is  granted  by  SCL  in  writing  to  GS  to  retain  that  data  on  the 
conditions  set  out  in  clause  10.4  of  this  Agreement. 

1 0.9  Upon  completion  of  the  Project,  GS  shall  waive  any  moral  rights  held  in  the 
matched  voter  file  records  or  message  testing  results  outlined  in  Schedule  2  of 
this  Agreement  to  SCL  and  GS  shall  not  object  to  SCL  taking  credit  for  the  records 
without  any  reference  to  GS  when  making  copies  of  the  records,  messages  or 
scores  to  be  delivered  to  clients, 

10.10  On  termination  of  this  agreement  (however  arising)  clauses  6.  8,  9, 10, 14, 15,  16, 
19, 21  and  23  will  survive  and  continue  in  full  force  and  effect. 

11.  Anti-Bribery 

11.1  Both  parties  will: 

11.1.1  comply  with  all  applicable  laws,  statutes,  regulations  relating  to  anti¬ 
bribery  and  anti-corruption  including  but  not  limited  to  the  Bribery  Act 
2010  (Relevant  Requirements); 

11.1.2  not  engage  in  any  activity,  practice  or  conduct  which  would  constitute 
an  offence  under  sections  1 , 2  or  6  of  the  Bribery  Act  2010  if  such 
activity,  practice  or  conduct  had  been  earned  out  in  the  UK; 

11.1.3  comply  with  SCL’s  anti-bribery  policies  that  may  update  them  from  time 
to  time  (Relevant  Policies);  and 

11.1.4  have  and  will  maintain  in  place  throughout  the  term  of  this  agreement  its 
own  policies  and  procedures,  including  adequate  procedures  under  the 
Bribery  Act  2010,  to  ensure  compliance  with  the  Relevant 
Requirements,  the  Relevant  Policies  and  clause  11,1.2,  and  will  enforce 
them  where  appropriate. 

1 1 .2  GS  must  ensure  that  any  person  associated  with  GS  who  is  performing  services  in 
connection  with  this  agreement  does  so  only  on  the  basis  of  a  written  contract 
which  imposes  on  and  secures  from  such  person  terms  equivalent  to  those 
imposed  on  GS  in  this  clause  1 1  (Relevant  Terms).  GS  will  be  responsible  for  the 
observance  and  performance  by  such  persons  of  the  Relevant  Terms,  and  will  be 
directly  liable  to  SCL  for  any  breach  by  such  persons  of  any  of  the  Relevant 
Terms. 

1 1 .3  For  the  purpose  of  this  clause  11,  the  meaning  of  adequate  procedures  and 
whether  a  person  is  associated  with  another  person  will  be  determined  in 
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accordance  with  section  7(2)  of  the  Bribery  Act  2010  {and  any  guidance  issued 
under  section  9  of  that  Act),  sections  6(5)  and  6(6)  of  that  Act  and  section  8  of  that 
Act  respectively, 

12.  Force  majeure 

GS  reserves  the  right  to  defer  the  date  for  performance  or  delivery  of  the  GS  Technology, 
GS  Profiled  Data  or  any  additional  Services  if  GS  is  prevented  from,  or  delayed  in,  carrying 
on  its  business  by  acts,  events,  omissions  or  accidents  beyond  its  reasonable  control, 
including  (without  limitation)  extremely  low  sample  response  rates  out  of  OS's  control  given 
the  temporal,  financial  or  material  constraints  of  this  Project,  strikes,  lockouts  or  other 
industrial  disputes  (whether  involving  the  workforce  of  GS  or  any  other  party),  failure  of  a 
utility  service  or  transport  network,  act  of  God,  war,  riot,  civil  commotion,  malicious  damage, 
accident,  breakdown  of  plant  or  machinery,  fire,  flood,  storm  or  default  of  suppliers  or 
subcontractors. 

13.  Variation 

No  variation  of  this  agreement  will  be  valid  unless  it  is  in  writing  and  signed  by  or  on  behalf 
of  an  authorised  representative  of  each  of  the  parties. 

14.  Waiver 

14.1  A  waiver  of  any  right  under  this  agreement  is  only  effective  if  it  is  in  writing.  No 
failure  or  delay  by  a  party  in  exercising  any  right  or  remedy  under  this  Agreement 
or  by  law  will  constitute  a  waiver  of  that  (or  any  other)  right  or  remedy,  nor 
preclude  or  restrict  its  further  exercise.  No  single  or  partial  exercise  of  such  right 
or  remedy  will  preclude  or  restrict  the  further  exercise  of  that  (or  any  other)  right  or 
remedy. 

1 4.2  Unless  specifically  provided  otherwise,  rights  arising  under  this  agreement  are 
cumulative  and  do  not  exclude  rights  provided  by  law. 

15.  Severance 

15.1  if  any  provision  of  this  agreement  (or  part  of  any  provision)  is  found  by  any  court 
or  other  authority  of  competent  jurisdiction  to  be  invalid,  illegal  or  unenforceable, 
that  provision  or  part  provision  will,  to  the  extent  required,  be  deemed  not  to  form 
part  of  this  agreement,  and  the  validity  and  enforceability  of  the  other  provisions  of 
this  agreement  will  not  be  affected. 

15.2  If  a  provision  of  this  agreement  (or  part  of  any  provision)  is  found  illegal,  invalid  or 
unenforceable,  the  provision  will  apply  with  the  minimum  modification  necessary 
to  make  it  legal,  valid  and  enforceable. 

16.  Entire  agreement 

16.1  This  Agreement  and  ail  schedules  appended  thereto,  constitutes  the  whole 
agreement  between  the  parties  and  supersedes  all  previous  agreements  between 
the  parties  relating  to  its  subject  matter. 

1 6.2  Nothing  in  this  Agreement  will  limit  or  exclude  any  liability  for  negligence  or  fraud. 

17.  Assignment 

SCL  will  not  without  the  prior  written  consent  of  GS,  assign,  transfer,  charge,  mortgage,  or 
deal  in  any  manner  with  all  or  any  of  its  rights  or  obligations  under  this  agreement. 
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18.  No  partnership  or  agency 

Nothing  in  this  agreement  is  intended  to,  or  shall  be  deemed  to,  constitute  a  partnership  or 
joint  venture  of  any  kind  between  either  of  the  parties,  nor  constitute  either  party  the  agent 
of  the  other  party  for  any  purpose.  Neither  party  shall  have  authority  to  act  as  agent  for,  or 
to  bind,  the  other  party  in  any  way, 

19.  Rights  of  third  parties 

A  person  who  is  not  a  party  to  this  Agreement  will  not  have  any  rights  under  or  in 
connection  with  it. 

20.  Advice  and  counsel 

Both  parties  acknowledge  and  warrant  to  each  other  that  they  have  read  and  fully 
understand  the  terms  and  provisions  of  this  Agreement,  have  had  an  opportunity  to  edit, 
amend  and  negotiate  the  terms  of  this  Agreement  to  reflect  their  wishes,  have  had  an 
opportunity  to  review  this  Agreement  with  independent,  qualified  and  competent  legal 
counsel  and  with  independent  technical  advice  from  subject  matter  experts,  and  have 
executed  this  Agreement  based  upon  their  own  judgment  and  advice  of  independent 
counsel, 

21.  Notices 

21.1  Any  notice  or  other  communication  given  under  this  agreement  must  be  in  writing 
(which  for  the  purposes  of  this  clause  20  includes  email)  and  delivered  personally, 
sent  by  first  class  post,  or  transmitted  by  fax  or  email  to  the  relevant  party's 
address  specified  in  this  agreement  or  to  such  other  address  or  fax  number  or 
email  address  as  either  party  may  have  last  notified  to  the  other.  A  confirmatory 
copy  of  any  notice  transmitted  by  fax  or  email  must  also  be  delivered  or  sent  by 
first  class  post  to  the  relevant  party. 

21 .2  Any  notice  or  other  communication  is  deemed  to  have  been  duly  given  on  the  day 
it  is  delivered  personalty,  or  on  the  second  Working  Day  following  the  date  it  was 
sent  by  post,  or  on  the  next  Working  Day  following  transmission  by  fax  or  email  or, 
in  the  case  of  any  notice  or  communication  delivered  by  pre-paid  airmail,  providing 
proof  of  postage  on  the  fifth  Working  Day  following  the  due  date  it  was  sent  by 
post. 

22.  Dispute  Resolution 

22.1  if  any  dispute  arises  in  connection  with  this  agreement,  the  parties  will  first  attempt 
to  resolve  it  in  good  faith  as  promptly  as  practicable.  If  such  dispute  cannot  be 
resolved  within  20  Working  Days  of  notice  of  the  dispute  or  within  such  further 
period  as  the  parties  may  agree  mutually,  the  parties  will  attempt  to  settle  it  by 
mediation  in  accordance  with  the  London  Court  of  International  Arbitration  (LCIA) 
under  the  LCIA  Rules,  which  Rules  are  deemed  to  be  incorporated  by  reference 
into  this  clause. 

22.2  The  number  of  arbitrators  shall  be  one  (01), 

22.3  The  seat,  or  legal  place,  of  arbitration  shall  be  London,  UK. 

22.4  The  language  to  be  used  in  the  arbitral  proceedings  shall  be  English. 

22.5  The  governing  law  of  the  contract  shall  be  the  substantive  law  of  England  and 
Wales. 

22.6  Each  party  shall  bear  its  own  costs  in  connection  with  any  mediation  and  the 
parties  .shall  bear  equally  the  costs  of  such  mediation. 


IQ 
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23.  Governing  law 

23.1  This  agreement,  and  any  dispute  or  claim  arising  out  of  or  in  connection  with  it  or 
its  subject  matter,  will  be  governed  by,  and  construed  in  accordance  with,  the  law 
of  England  and  Wales. 

23.2  The  parties  irrevocably  agree  that  the  courts  of  England  and  Wales  will  have 
exclusive  jurisdiction  to  settle  any  dispute  or  claim  that  arises  out  of,  or  in 
connection  with,  this  agreement  or  its  subject  matter. 


it 
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The  parlies  have  signed  this  agreement  on  the  date  set  out  above. 


SIGNED  by  /j! 

DR  ALEKSANDR  KOGAN  for  and  dtf 
behalf  of  GLOBAL  SCIENCE  RESEARCH 
LTD  In  the  presence  ot: 


Witness: 

Signature 

Name 

Occupation 

Address 


SIGNED  bv 

ALEXANDER  NtX  for  and  on  behalf  of  SCI 
Elections  Limited  in  the  presence  of: 


Witness: 

Signature 

Name 

Occupation 

Address 
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The  parties  have  signed  this  agreement  on  the  date  set  out  above, 


SIGNED  by _ 

DR  ALEKSANDR  KOGAN  for  and  on 
behalf  of  GLOBAL  SCIENCE  RESEARCH 
LTD  in  the  presence  of: 


Witness: 

Signature 

Name 

Occupation 

Address 


v'\ 

SIGNED  by  " 

ALEXANDER  NIX  for  and  on  behalf  of  SCL 
Elections  limited  in  the  presence  of: 


Signature 

Name 


Occupation  :  £<*.*,  £/*/°£&i££ 

Address  :  10%  sanh  S7*ltl 

ms  \£f- 
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Schedule  1 

Definitions  and  interpretations 

1 ,  In  this  agreement,  including  the  schedules,  the  following  words  and  expressions  have 
the  following  meanings: 


Authorised  Person  to  be  appointed  by  each  party, 


Commencement  Date 
Deliverables 

Documentation 

Fees 

Insolvency  Event 


intellectual  Property  Rights 


the  date  of  this  agreement. 

the  services  to  be  delivered  by  GS  to  SCL  in 
accordance  with  Schedule  2, 

means  any  supporting  product  help  and/or  technical 
specifications  documentation  provided  by  GS  to 
SCL. 

the  fees  payable  in  respect  of  the  Licence  and 
Project  payable  as  referred  to  in  and  in  accordance 
with  the  Project  and  Specification  Schedule. 

where  the  relevant  party: 

1 .  has  a  receiver,  administrative  receiver, 
administrator,  manager  or  official  receiver 
appointed  over  its  affairs; 

2.  goes  into  liquidation,  unless  for  the  purpose 
of  a  solvent  reconstruction  or  amalgamation; 

3.  has  distress,  execution  or  sequestration 
levied  or  issued  against  any  part  of  its  assets 
and  is  not  paid  within  seven  days; 

4.  is  otherwise  unable  to  pay  its  debts  as  they 
fall  due  within  the  meaning  of  section  123 
Insolvency  Act  1986;  or 

5.  is  subject  to  any  analogous  event  under  the 
law  of  any  relevant  jurisdiction. 

all  patents,  rights  to  inventions,  utility  models, 
copyright  and  related  rights,  trade  marks,  service 
marks,  trade,  business  and  domain  names,  rights  in 
trade  dress  or  get-up,  rights  in  goodwill  or  to  sue  for 
passing  off,  unfair  competition  rights,  rights  in 
designs,  rights  in  computer  software,  database 
rights,  rights  in  online  data  harvested  by  GS  and  in 
online  social  media  data  scored  or  collected  by  GS, 
topography  rights,  rights  in  confidential  information 
(including  know-how  and  trade  secrets)  and  any 
other  intellectual  property  rights,  in  each  case 
whether  registered  or  unregistered  and  including  all 
applications  for  and  renewals  or  extensions  of  such 
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rights,  and  all  similar  or  equivalent  rights  or  forms  of 
protection  in  any  part  of  the  world. 

Licence  the  licence  agreement  entered  into  between  GS  and 

SCL  on  the  date  of  this  Agreement  as  specified  in 
clause  6. 

Personal  Data  as  defined  in  the  Data  Protection  Act  1 998. 

project  the  project  set  out  in  the  Project  and  Specification 

Schedule. 


Services  any  services  provided  GS  to  SCL  in  addition  to  the 

Licence  as  set  out  in  Schedule  2,  as  may  be 
amended  by  the  parties  from  time  to  time. 

Territory  United  States  of  America 

Working  Day  a  day  (other  than  a  Saturday  or  Sunday)  on  which 

banks  are  open  for  domestic  business  in  the  City  of 

London,  UK. 

2,  Schedule  and  paragraph  headings  will  not  affect  the  interpretation  of  these 
Conditions. 

3,  A  person  includes  a  natural  person,  corporate  or  unincorporated  body  (whether  or 
not  having  separate  legal  personality). 

4,  The  schedules  form  part  of  this  agreement  and  will  have  effect  as  if  set  out  in  full  in 
the  body  of  this  agreement  and  any  reference  to  this  agreement  includes  the 
schedules. 

$  Words  In  the  singular  will  include  the  plural  and  vice  versa. 

6.  A  reference  to  a  statute  or  statutory  provision  is  a  reference  to  it  as  it  is  in  force  for 
the  time  being,  taking  account  of  any  amendment,  extension,  or  re-enactment  and 
includes  any  subordinate  legislation  for  the  time  being  in  force  made  under  if. 

7.  Any  obligation  in  this  agreement  on  a  person  not  to  do  something  includes  an 
obligation  not  to  agree,  allow,  permit  or  acquiesce  in  that  thing  being  done, 

8.  References  to  clauses  and  schedules  are  to  the  clauses  of  and  schedules  to  this 
agreement. 

9.  Headings  are  for  convenience  only  and  are  to  be  ignored  in  interpreting  this 
agreement. 
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Schedule  2 

Project  and  Specification  Schedule 


Background  and  Rationale 

To  infer  psychological  profiles,  self-report  personality  lest  data,  political  party  preference  and 
moral  value  data  are  collected  as  described  below  in  “Process  Overview'.  After  data  is  collected, 
models  are  built  using  psychometric  techniques  (e,g,  factor  analysis,  dimensional  scaling,  etc) 
which  use  Facebook  likes  to  predict  people's  personality  scores.  These  models  are  validity  tested 
on  users  who  were  not  part  of  the  training  sample.  Trait  predictions  based  on  Facebook  likes  are 
at  near  test-ratest  levels  and  have  been  compared  to  the  predictions  their  romantic  partners, 
family  members,  and  friends  make  about  their  traits.  In  all  previous  cases,  the  computer¬ 
generated  scores  performed  the  best.  Thus,  the  computer-generated  scores  can  be  more 
accurate  than  even  the  knowledge  of  very  close  friends  and  family  members. 

GS’s  methodology  is  different  from  most  social  research  measurement  instruments  in  that  it  is  not 
soley  based  on  self-reported  data.  Using  observed  data  from  Facebook  users’  profiles  makes 
GS's  measurement  genuinely  behavioural.  Interviews,  surveys,  and  long  lists  of  Likert  scales  rely 
on  using  a  respondent’s  answers  in  a  specific  situation  as  a  proxy  for  observational  data 
generated  over  long  periods  of  tracking  individuals.  These  types  of  data  collection  are  Frequently 
met  with  problems  of  interviewer  bias,  noise  generated  by  anomalies  in  verbal  presentation  of 
survey  questions,  confounding  influence  of  participant’s  mood,  and  the  difficulties  in  estimating 
long-term  personality  behaviour  from  short  and  volatile  psychometric  questionnaires,  among 
others.  Furthermore,  these  methods  rely  on  people  being  willing  to  respond  to  surveys-thus, 
creating  a  sample  that  is  biased  towards  more  altruistic  and  compliant  members  of  society.  Since 
this  option  is  not  reliant  on  people  answering  surveys,  this  bias  is  completely  avoided. 

OS's  method  represents  a  scalable,  digital  solution  to  psychometric  profiling  that  avoids  these 
concerns.  Using  Facebook  data  as  a  repository  of  observed  online  behaviours  enables  the 
analysing  and  modelling  of  said  data  to  create  robust  personality  psychology  profiles  on  a  scale 
that  reaches  into  the  millions,  compared  to  less  than  100  profiles  generated  by  the  laboratory- 
based  personality  observation  methods  of  the  past  over  a  period  of  months.  OS's  methods  also 
allow  SCL  to  substantially  gain  value  and  benefit  from  insight  derived  from  people  who  live 
outside  the  target  eleven  states,  as  their  data  is  also  used  to  create,  refine  and  make  more 
accurate  human  personality  models  that  can  then  score  those  who  live  in  the  eleven  target  states. 

The  resulting  deliverable  is  a  less  costly,  more  detailed,  and  more  quickly  collected  psychological 
profile  at  the  same  or  greater  volume  of  individuals  profiled  than  other  options,  like  standard 
political  polling  or  phone  samples.  GS’s  method  relies  on  a  pre-existing  application  functioning 
under  Facebook's  old  terms  of  service.  New  applications  are  not  able  to  access  friend  networks 
and  no  other  psychometric  profiling  applications  exist  under  the  old  Facebook  terms. 


Geographic  Scope  (“States”) 

The  GS  Profiled  Data  will  only  be  appended  to  voter  file  records  (SCL  Data)  supplied  to  GS  by 
SCL  in  the  following  eleven  States  in  the  Territory: 


_1_ 

Arkansas 

6.  Nevada 

Colorado 

7.  New  Hampshire 

3. 

Florida 

8.  North  Carolina 

Iowa 

9,  Oregon 

5. 

Louisiana 

10.  South  Carolina 
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11.  West  Virginia 
Phased  Implementation 

There  will  be  two  phases  in  this  project: 

Phase  I:  “Trial  Sample  Phase" 

This  phase  will  be  used  by  SCL  to  assess  the  GS  Technology  and  GS  Profiled  Data, 

This  phase  will  begin  on  the  Commencement  Date  and  last  for  seven  (07)  Working  Days  from 
that  date. 

Phase  II:  “Full  Sample  Phase" 

This  phase  will  be  used  by  SCL  for  message  testing  and  to  generate  a  “Super  Sample"  for  its 
political  modelling  project  in  the  aforementioned  eleven  (11)  States  in  the  Territory. 

This  phase  will  begin  the  day  following  the  end  of  Phase  1  and  last  for  20  Working  Days. 

Optional  Timeline  Extension 

If  SCL  determines,  at  its  sole  and  exclusive  discretion,  that  GS  is  making  genuine  and 
reasonable  efforts  to  deliver  the  Project,  but  constraints  outside  OS's  reasonable  control  are 
delaying  progress,  SCL  may  choose  to  grant  GS  up  to  an  additional  10  Working  Days  to 
complete  the  deliverables  of  this  Project  whereby  for  the  purposes  of  this  Agreement  GS  will 
be  considered  to  have  delivered  the  Project  on  time,. _ _ _  . 


Minimum  Data  Contents  for  Matched  Records 

All  matched  records  supplied  by  GS  to  SCL  must  contain  the  following: 

*  Forename 
«  Surname 

*  Gender 

*  Location 

*  Modelled  GS  Big  Five  Personality  Scores  (x5) 

*  Modelled  GS  Republican  Party  Support  Score 

*  Modelled  GS  Political  Involvement/Enthusiasm  Score 

*  Modelled  GS  Political  Volatility  Score _ _ _ 


Additional  Data  Contents  for  Matched  Records 

SCL  recognises  that  not  ail  its  records  matched  to  GS  Data  will  contain  the  same  information  and 
that  coverage  of  different  data  points  will  vary  within  the  GS  Data  in  the  eleven  States,  However, 
where  a  matched  record  in  one  of  the  eleven  States  contains  the  following  data,  GS  wilt  also 
provide: 

♦  Date  of  Birth  {Partial  or  Complete) 

«  Zip  Code 

♦  Residential  Address  (or  any  component  thereof) 

♦  Answers  to  political  surveys,  if  they  completed  one  _ 


Quantify  of  GS  Scored  Records  Matched  to  SCL  Voter  Records  (Triai  Sample  Phase) 

The  total  size  of  the  initial  Trial  Sample  will  range  between  ten  thousand  (10,000)  and  thirty 
thousand  (30,000)  respondents  in  the  Territory. 
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Quantity  of  GS  Scored  Records  Matched  to  SCL  Voter  Records  (Full  Sample  Phase) 

The  total  number  of  GS  records  matched  to  SCL  records  in  the  eleven  States  will  range  between 
one  and  a  half  million  (1,500,000)  and  two  million  (2,000,000)  and  GS  will  make  reasonable 
efforts  to  provide  two  million  (2,000,000)  matched  records,  or  as  close  to  that  quantity  as 

possible. 


Fees 

Contract  Fee:  Three  Pounds  Fourteen  Pence  (GBP  £3.14). 

Trial  Sample  Fee:  Fee  shall  not  exceed  Five  US  Dollars  (USD  $5,00)  per  successful  Seed 
Respondent. 

Full  Subscription  Fee:  To  be  established  after  the  Trial  Sample  and  where  the  total  Subscription 
Fee,  when  divided  by  scored  records  successfully  matched  to  SCL’s  voter  file  and  consumer 
database,  shall  not  exceed  the  price  of  Seventy-Five  US  Cents  (USD  50,75)  per  matched  record. 


Process  Overview 

The  approach  has  several  steps: 


1 .  GS  generates  an  initial  “seed  sample"  using  online  panels. 

2.  GS  uses  its  battery  of  psychometric  inventories  to  investigate  psychological,  dispositional 
and/or  attitudinai  facets  of  the  sampled  respondents. 

3.  GS  guides  respondents  through  its  proprietary  data  harvesting  technology  (GS 
Technology)  and  upon  consent  of  the  respondent  the  GS  Technology  scrapes  and 
retains  the  respondent’s  Facebook  profile  and  a  quantity  of  data  on  that  respondent’s 
Facebook  friends. 

4.  The  psychometric  data  from  the  seed  sample,  as  well  as  the  Facebook  profile  and 
Facebook  friend  data  is  run  through  a  proprietary  set  of  algorithms  that  models  and 
predicts  psychological,  dispositional  and/or  attitudinai  facets  of  each  Facebook  record. 

5.  TOe  output  of  step  4  is  a  series  of  scores  for  each  record, 

6.  GS  receives  a  dataset  from  SCL  and  conducts  a  matching  exercise  to  append  two  million 
(2,000,000)  records  with  GS  scores. 

7.  GS  exports  the  matched  records  back  to  SCL. 


Phase  I  Training  Set 

in  order  to  effectively  create  psychological  profiles  based  on  relationships  to  Facebook  data,  a  set 
of  training  data  will  be  necessary.  This  data  gathering  wilt  be  composed  of  a  full  personality 
inventory  and  Facebook  scrape  for  each  individual  included.  Furthermore,  procedures  in  the 
training  set  must  meet  the  highest  possible  standards  of  normalised  demographic  distribution  and 
satisfaction  of  statistical  assumptions  surrounding  linear  modelling  analysis. 
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The  ultimate  product  of  the  training  set  is  creating  a  'gold  standard’  of  understanding  personality 
from  Facebook  profile  information,  much  like  charting  a  course  to  sail.  Once  the  procedure  to 
produce  personality  profiles  from  Facebook  data  is  finalised,  some  free  radical  factors  will  impact 
these  predictions  within  a  controlled  error  rate,  just  as  a  charted  course  to  sail  must  be  as  perfect 
as  possible  account  for  multiple  unknown  tidal,  meteorological,  and  geographic  factors.  Sampling 
in  this  phase  will  be  repeated  until  assumptions  and  distributions  are  met. 


Assumptions  of  Linear  Modelling 


Linearity:  Predictor  variables  must  be  correlated  (related)  to  outcome  variables  in  a  linear 
fashion. 

Independence:  Residuals  from  terms  ofthe  regression  must  be  independent 
(uncorrelated).  We  will  use  a  Durbin-Watson  test  to  produce  independence  test  statistics. 

Homoscedasticity:  Each  level  of  each  predictor  variable  must  be  subjected  to  tests  of 
variance  and  cross-compared,  P-values  produced  from  tests  comparing  variance  results 
across  predictor  levels  wit!  determine  violation  or  satisfaction  of  this  assumption. 

Error  distribution  normality:  The  residuals  from  the  modelling  procedure  must  be 
checked  for  normality.  T-tests  comparing  means  of  the  model  and  observed  data  must 
produce  p-values  that  are  insignificant. 

External  variable  independence:  All  related  data  collected  from  individuals,  which  are 
not:  included  in  the  models  but  are  significantly  correlated  to  outcome  variables,  must  be 
uncorrelated  to  predictor  variables. 


Message  Testing 

Throughout  Phase  II  SCL’s  messaging  concepts  will  be  tested  by  appending  message  testing 
procedures  to  a  subset  of  seed  sample.  This  experimental  design  will  be  measured  using  a 
modified  AD  ACL  neurological  arousal  measure  to  test  emotional  response  to  message  stimuli. 
Testing  in  this  manner  will  facilitate  direct  comparison  of  psychological  profiles  to  message  test 
outcomes  for  individuals  matched  to  the  SCL  database  as  concurrent  processes.  This  message 
testing  procedure  streamlines  design  by  reducing  call  centre  load  and  optimising  cost  through 
pre-matched  online  samples.  For  the  avoidance  of  doubt,  message  testing  shall  occur 
concurrently  to  the  Phase  I!  Full  Sample  and  political  message  testing  shall  be  incorporated  into 
the  seed  samples  to  reduce  costs  and  optimise  the  timeline. 


Demographic  Distribution  Analysis 

As  matched  psychological  profiles  from  each  cohort  are  received  by  SCL,  frequency  analysis  on 
each  of  the  aforementioned  demographic  variables  will  be  conducted  to  unsure  that  the 
distribution  of  these  variables  matches  the  distribution  of  the  complete  voter  database  in  each 
state.  Should  these  skews  be  found,  subsequent  iterations  will  engage  in  targeted  data  collection 
procedures  through  multiple  platforms  to  eliminate  these  biases,  thus  ensuring  that  psychological 
profiles  cover  all  possible  groups  to  emerge  from  target  voter  clustering.  If  necessary,  brief  phone 
scripts  with  single-trait  questions  will  be  conducted  to  polish  off  data  gaps  which  cannot  be  filled 
in  from  targeted  online  samples. 
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